CVE-2026-31873
Unknown
Description
Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes('data:') returns false. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks. This vulnerability is fixed in 2.1.11.
SeverityUnknown
CVSS0.0
Exploit probability—
ProductUnjs Unhead
PublishedMar 12, 2026
First seenMar 12, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- unjs unhead2.1.11 or later
- unhead2.1.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| unjs unhead | v < 2.1.11 | 2.1.11 |
| unheadnpm | v < 2.1.11 | 2.1.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.