CVE-2026-39315

Name of the Vulnerable Software and Affected Versions Unhead versions prior to 2.1.13

Description The useHeadSafe() composable fails to properly sanitize user-supplied content intended for the document head. The hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts uses regular expressions with fixed-width digit caps to decode HTML entities before checking for blocked URI schemes such as javascript:, data:, and vbscript:. Because the HTML5 specification allows an unlimited number of leading zeros in numeric character references, entities that exceed these digit caps are skipped by the decoder. Consequently, the startsWith('javascript:') check is bypassed, and the makeTagSafe() function writes the raw value into the Server-Side Rendering (SSR) HTML output. The browser then natively decodes these padded entities, allowing the execution of blocked URIs.

Recommendations Update to version 2.1.13.