Cybe4Sent1Nel

**Name of the Vulnerable Software and Affected Versions** Unhead versions prior to 2.1.13 **Description** The `useHeadSafe()` composable fails to properly sanitize user-supplied content intended for the document head. The `hasDangerousProtocol()` function in `packages/unhead/src/plugins/safe.ts` uses regular expressions with fixed-width digit caps to decode HTML entities before checking for blocked URI schemes such as `javascript:`, `data:`, and `vbscript:`. Because the HTML5 specification allows an unlimited number of leading zeros in numeric character references, entities that exceed these digit caps are skipped by the decoder. Consequently, the `startsWith('javascript:')` check is bypassed, and the `makeTagSafe()` function writes the raw value into the Server-Side Rendering (SSR) HTML output. The browser then natively decodes these padded entities, allowing the execution of blocked URIs. **Recommendations** Update to version 2.1.13.