CVE-2026-31860: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in unjs unhead
Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11.
AI Analysis
Technical Summary
CVE-2026-31860 is a cross-site scripting vulnerability classified under CWE-79 affecting the unhead package, a document head and template manager commonly used in SSR frameworks such as Nuxt. The vulnerability exists in versions prior to 2.1.11 due to improper input neutralization during web page generation. Specifically, the useHeadSafe() composable, recommended by Nuxt documentation for safely handling user-generated content, can be bypassed to inject arbitrary HTML attributes into SSR-rendered <head> tags. The root cause lies in the acceptDataAttrs function, which permits any attribute key starting with 'data-' to be included in the final HTML without sufficiently validating the entire attribute name. This allows attackers to craft attribute keys containing spaces or special characters that disrupt HTML attribute parsing, enabling injection of event handlers or malicious scripts. Since the <head> element is rendered server-side, this can lead to persistent XSS attacks affecting all users viewing the page. The vulnerability requires no privileges or authentication but does require user interaction, such as visiting a maliciously crafted page. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, but user interaction needed. No known exploits have been reported in the wild as of publication. The issue was addressed and fixed in unhead version 2.1.11 by improving attribute validation to prevent injection of malformed or malicious attributes.
Potential Impact
This vulnerability enables attackers to perform cross-site scripting attacks by injecting arbitrary HTML attributes and event handlers into the <head> section of SSR-generated pages. Successful exploitation can lead to execution of malicious scripts in the context of the affected website, potentially resulting in session hijacking, credential theft, defacement, or delivery of malware to users. Organizations using unhead versions prior to 2.1.11 in their SSR frameworks, especially those handling user-generated content in the document head, are at risk. The impact is significant for websites relying on unhead for safe content injection, as it undermines the trust boundary between user input and rendered HTML. Although no known exploits are currently reported, the vulnerability's presence in a widely used composable recommended by Nuxt documentation increases the likelihood of future exploitation attempts. The medium severity score indicates moderate risk, but the potential for persistent XSS in high-traffic web applications elevates the importance of timely remediation. Exploitation requires user interaction, limiting automated mass exploitation but still posing a threat to end users. Organizations with public-facing SSR applications leveraging unhead should consider this a priority vulnerability to address.
Mitigation Recommendations
The primary mitigation is to upgrade the unhead package to version 2.1.11 or later, where the vulnerability is fixed by enhanced validation of attribute keys in acceptDataAttrs. Until upgrading is possible, organizations should audit their use of useHeadSafe() and avoid passing untrusted user input directly to it, especially input that could contain spaces or special characters in attribute names. Implement additional server-side input validation or sanitization to restrict attribute keys to a safe whitelist beyond just the 'data-' prefix. Employ Content Security Policy (CSP) headers to restrict script execution and reduce the impact of potential XSS attacks. Monitor application logs and user reports for suspicious activity indicative of exploitation attempts. Educate developers on the risks of improper attribute injection in SSR contexts and encourage secure coding practices when handling user-generated content. Finally, conduct thorough security testing, including automated scanning and manual code review, to detect similar injection flaws in related components.
Affected Countries
United States, Germany, France, United Kingdom, Canada, Australia, Netherlands, Japan, South Korea, India
CVE-2026-31860: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in unjs unhead
Description
Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11.
AI-Powered Analysis
Technical Analysis
CVE-2026-31860 is a cross-site scripting vulnerability classified under CWE-79 affecting the unhead package, a document head and template manager commonly used in SSR frameworks such as Nuxt. The vulnerability exists in versions prior to 2.1.11 due to improper input neutralization during web page generation. Specifically, the useHeadSafe() composable, recommended by Nuxt documentation for safely handling user-generated content, can be bypassed to inject arbitrary HTML attributes into SSR-rendered <head> tags. The root cause lies in the acceptDataAttrs function, which permits any attribute key starting with 'data-' to be included in the final HTML without sufficiently validating the entire attribute name. This allows attackers to craft attribute keys containing spaces or special characters that disrupt HTML attribute parsing, enabling injection of event handlers or malicious scripts. Since the <head> element is rendered server-side, this can lead to persistent XSS attacks affecting all users viewing the page. The vulnerability requires no privileges or authentication but does require user interaction, such as visiting a maliciously crafted page. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, but user interaction needed. No known exploits have been reported in the wild as of publication. The issue was addressed and fixed in unhead version 2.1.11 by improving attribute validation to prevent injection of malformed or malicious attributes.
Potential Impact
This vulnerability enables attackers to perform cross-site scripting attacks by injecting arbitrary HTML attributes and event handlers into the <head> section of SSR-generated pages. Successful exploitation can lead to execution of malicious scripts in the context of the affected website, potentially resulting in session hijacking, credential theft, defacement, or delivery of malware to users. Organizations using unhead versions prior to 2.1.11 in their SSR frameworks, especially those handling user-generated content in the document head, are at risk. The impact is significant for websites relying on unhead for safe content injection, as it undermines the trust boundary between user input and rendered HTML. Although no known exploits are currently reported, the vulnerability's presence in a widely used composable recommended by Nuxt documentation increases the likelihood of future exploitation attempts. The medium severity score indicates moderate risk, but the potential for persistent XSS in high-traffic web applications elevates the importance of timely remediation. Exploitation requires user interaction, limiting automated mass exploitation but still posing a threat to end users. Organizations with public-facing SSR applications leveraging unhead should consider this a priority vulnerability to address.
Mitigation Recommendations
The primary mitigation is to upgrade the unhead package to version 2.1.11 or later, where the vulnerability is fixed by enhanced validation of attribute keys in acceptDataAttrs. Until upgrading is possible, organizations should audit their use of useHeadSafe() and avoid passing untrusted user input directly to it, especially input that could contain spaces or special characters in attribute names. Implement additional server-side input validation or sanitization to restrict attribute keys to a safe whitelist beyond just the 'data-' prefix. Employ Content Security Policy (CSP) headers to restrict script execution and reduce the impact of potential XSS attacks. Monitor application logs and user reports for suspicious activity indicative of exploitation attempts. Educate developers on the risks of improper attribute injection in SSR contexts and encourage secure coding practices when handling user-generated content. Finally, conduct thorough security testing, including automated scanning and manual code review, to detect similar injection flaws in related components.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-09T19:02:25.012Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69b2fb902f860ef943d10b6a
Added to database: 3/12/2026, 5:44:48 PM
Last enriched: 3/12/2026, 6:00:22 PM
Last updated: 3/12/2026, 8:34:25 PM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.