CVE-2026-31860

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31860", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T19:02:25.012Z", "datePublished": "2026-03-12T17:18:20.452Z", "dateUpdated": "2026-03-13T16:26:51.670Z"}, "containers": {"cna": {"title": "Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv"}], "affected": [{"vendor": "unjs", "product": "unhead", "versions": [{"version": "< 2.1.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T17:18:20.452Z"}, "descriptions": [{"lang": "en", "value": "Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11."}], "source": {"advisory": "GHSA-g5xx-pwrp-g3fv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T16:26:47.686961Z", "id": "CVE-2026-31860", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:26:51.670Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31860", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T16:26:47.686961Z"}}}], "references": [{"url": "https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:26:40.074Z"}}], "cna": {"title": "Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check", "source": {"advisory": "GHSA-g5xx-pwrp-g3fv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "unjs", "product": "unhead", "versions": [{"status": "affected", "version": "< 2.1.11"}]}], "references": [{"url": "https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv", "name": "https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T17:18:20.452Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31860", "state": "PUBLISHED", "dateUpdated": "2026-03-13T16:26:51.670Z", "dateReserved": "2026-03-09T19:02:25.012Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T17:18:20.452Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "unhead", "vendor": "unjs", "versions": [{"status": "affected", "version": "< 2.1.11"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:unjs:unhead:*:*:*:*:*:*:*:*", "matchCriteriaId": "67F3AFEA-7DE2-46CC-AC50-D8B49F57C37E", "versionEndExcluding": "2.1.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This vulnerability is fixed in 2.1.11."}, {"lang": "es", "value": "Unhead es un gestor de cabecera de documento y plantillas. Antes de la 2.1.11, se puede eludir useHeadSafe() para inyectar atributos HTML arbitrarios, incluyendo manejadores de eventos, en etiquetas renderizadas por SSR. Este es el composable que la documentaci\u00f3n de Nuxt recomienda para manejar de forma segura contenido generado por el usuario. La funci\u00f3n acceptDataAttrs (safe.ts, l\u00ednea 16-20) permite cualquier clave de propiedad que comience con 'data-' hasta el HTML final. Solo verifica el prefijo, no si la clave contiene espacios u otros caracteres que rompen el an\u00e1lisis de atributos HTML. Esta vulnerabilidad est\u00e1 corregida en la 2.1.11."}], "id": "CVE-2026-31860", "lastModified": "2026-06-17T10:34:38.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31860", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T16:26:47.686961Z", "version": "2.0.3"}}]}, "published": "2026-03-12T18:16:24.227", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "unhead", "source": "cna", "vendor": "unjs"}, "product": "unhead", "vendor": "unjs"}], "analysis": {"en": {"generated_at": "2026-03-17T15:43:42.400780+00:00", "value": {"mitigation_remediation": ["Upgrade unhead to version 2.1.11 or newer.", "Verify that no untrusted data is passed to useHeadSafe with arbitrary attribute keys.", "Restrict useHeadSafe to a whitelist of valid attributes if an upgrade cannot be applied immediately.", "Apply web application firewall rules to block unsolicited XSS payloads.", "Monitor web traffic for XSS indicators and review server\u2011side rendered <head> content for anomalies."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting via attribute injection in SSR"}, "threat_synthesis": {"affected_systems": "Vendors affected are unjs:unhead. All releases prior to version 2.1.11 are vulnerable. Versions 2.1.11 and later contain the fix.", "description_and_impact": "Unhead's useHeadSafe composable can be bypassed to inject arbitrary HTML attributes, including event handlers, into server\u2011side rendered <head> tags. The acceptDataAttrs function permits any key starting with data- without checking for spaces or characters that break attribute parsing. This flaw allows an attacker to insert malicious client\u2011side scripts, resulting in a stored XSS vulnerability.", "risk_and_exploitability": "The CVSS base score is 5.3, indicating moderate severity, while the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, implying low expected exploitation. The likely attack vector is through user\u2011supplied data that is passed to useHeadSafe in an SSR context; the attacker can craft a key that starts with data- but contains malicious attribute names to trigger the XSS. No specific exploitation conditions are outlined beyond the presence of user input in useHeadSafe."}}}}, "created": "2026-03-13T09:50:53.621497+00:00", "updated": "2026-03-20T15:48:50.949084+00:00", "vendors": ["unjs", "unjs$PRODUCT$unhead"]}