org.webjars.npm:unhead__vue (>=1.11.20, <=2.1.10), org.webjars.npm:vueuse__head (1.0.22) potentially affected by CVE-2026-31860 via org.webjars.npm:unhead (>=1.11.20, <=2.1.10)

org.webjars.npm:unhead MAVEN version =1.11.20, =1.11.20, =2.1.10 - org.webjars.npm:vueusehead 1.0.22 Source cves: CVE-2026-31860 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15627228...

unhead 跨站脚本漏洞

unhead is a document header and template manager developed by UnJS. Versions of unhead prior to 2.1.11 contained a cross-site scripting vulnerability. This vulnerability stemmed from the link.href check being case-sensitive, which could allow attackers to inject arbitrary CSS for UI masking or da...

PT-2026-25020

Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs...

unhead 跨站脚本漏洞

unhead is a document header and template manager developed by UnJS. Versions of unhead prior to 2.1.11 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of the useHeadSafe function, which could be bypassed, allowing arbitrary HTML attributes to be injected in...

PT-2026-25021

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe safe.ts uses String.includes, which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes'data...

XSS in user supplied title

Issue The useHead function does not sanitize tags inserted in each property, including the title property. Context The useHead repository is a wrapper around vueuse/head which wraps unjs/unhead which wraps harlan-zw/zhead. The possibility of XSS is not described as being a vulnerability in the ro...