Threats affecting pkg:npm/unhead

CVE-2026-31860 is a medium severity cross-site scripting (XSS) vulnerability in the unhead package, a document head and template manager used in SSR contexts. Versions prior to 2.1.11 allow attackers to bypass the useHeadSafe() composable, which is intended to safely handle user-generated content, by injecting arbitrary HTML attributes including event handlers into <head> tags. The vulnerability arises because the acceptDataAttrs function only checks if attribute keys start with 'data-' but does not validate for spaces or special characters that can break HTML attribute parsing, enabling malicious payloads. This flaw affects server-side rendered pages and requires user interaction to trigger. Although no known exploits are reported, the vulnerability can lead to client-side script execution, impacting confidentiality and integrity of user sessions. The issue is fixed in version 2.1.11.