CVE-2026-39315

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39315", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-06T19:31:07.266Z", "datePublished": "2026-04-09T17:54:07.488Z", "dateUpdated": "2026-04-13T15:38:52.507Z"}, "containers": {"cna": {"title": "Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()", "problemTypes": [{"descriptions": [{"cweId": "CWE-184", "lang": "en", "description": "CWE-184: Incomplete List of Disallowed Inputs", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w"}, {"name": "https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299", "tags": ["x_refsource_MISC"], "url": "https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299"}, {"name": "https://github.com/unjs/unhead/releases/tag/v2.1.13", "tags": ["x_refsource_MISC"], "url": "https://github.com/unjs/unhead/releases/tag/v2.1.13"}], "affected": [{"vendor": "unjs", "product": "unhead", "versions": [{"version": "< 2.1.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T17:54:07.488Z"}, "descriptions": [{"lang": "en", "value": "Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13."}], "source": {"advisory": "GHSA-95h2-gj7x-gx9w", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T15:28:38.766188Z", "id": "CVE-2026-39315", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:38:52.507Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39315", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:28:38.766188Z"}}}], "references": [{"url": "https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:27:54.437Z"}}], "cna": {"title": "Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()", "source": {"advisory": "GHSA-95h2-gj7x-gx9w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "unjs", "product": "unhead", "versions": [{"status": "affected", "version": "< 2.1.13"}]}], "references": [{"url": "https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w", "name": "https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299", "name": "https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/unjs/unhead/releases/tag/v2.1.13", "name": "https://github.com/unjs/unhead/releases/tag/v2.1.13", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-184", "description": "CWE-184: Incomplete List of Disallowed Inputs"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T17:54:07.488Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39315", "state": "PUBLISHED", "dateUpdated": "2026-04-13T15:38:52.507Z", "dateReserved": "2026-04-06T19:31:07.266Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-09T17:54:07.488Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "unhead", "vendor": "unjs", "versions": [{"status": "affected", "version": "< 2.1.13"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:unjs:unhead:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "2B95120E-BF74-4840-A52D-4D2499E8F958", "versionEndExcluding": "2.1.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13."}, {"lang": "es", "value": "Unhead es un gestor de cabeceras de documento y plantillas. Antes de la versi\u00f3n 2.1.13, useHeadSafe() es el composable que la propia documentaci\u00f3n de Nuxt recomienda expl\u00edcitamente para renderizar contenido proporcionado por el usuario en [head] de forma segura. Internamente, la funci\u00f3n hasDangerousProtocol() en packages/unhead/src/plugins/safe.ts decodifica entidades HTML antes de verificar esquemas URI bloqueados (javascript_disabled: , data:, vbscript:). El decodificador utiliza dos expresiones regulares con l\u00edmites de d\u00edgitos de ancho fijo. La especificaci\u00f3n HTML5 no impone l\u00edmite en los ceros iniciales en las referencias de caracteres num\u00e9ricos. Cuando una entidad con relleno excede el l\u00edmite de d\u00edgitos de la expresi\u00f3n regular, el decodificador la omite silenciosamente. La cadena sin decodificar se pasa entonces a startsWith(\u2019javascript_disabled: \u2019), que no coincide. makeTagSafe() escribe el valor sin procesar directamente en la salida HTML SSR. El analizador HTML del navegador decodifica la entidad con relleno de forma nativa y construye el URI bloqueado. Esta vulnerabilidad se corrige en la versi\u00f3n 2.1.13."}], "id": "CVE-2026-39315", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39315", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T15:28:38.766188Z", "version": "2.0.3"}}]}, "published": "2026-04-09T18:17:01.433", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/unjs/unhead/releases/tag/v2.1.13"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-184"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "unhead", "source": "cna", "vendor": "unjs"}, "product": "unhead", "vendor": "unjs"}], "analysis": {"en": {"generated_at": "2026-04-14T21:37:27.036757+00:00", "value": {"mitigation_remediation": ["Upgrade Unhead to version 2.1.13 or later."], "summary": {"action": "Patch Now", "impact": "Browser XSS Vulnerability"}, "threat_synthesis": {"affected_systems": "The affected product is the Node.js library Unhead by the unjs organization. All releases prior to version 2.1.13 are vulnerable, including any upstream Nuxt.js projects that use useHeadSafe() to render user\u2011supplied content in the document head.\n", "description_and_impact": "Unhead\u2019s useHeadSafe() previously attempted to defend against dangerous protocols by decoding HTML entities before checking for blocked URI schemes. The decoder used fixed\u2011width regular expressions, which silently skipped leading\u2011zero padded numeric character references that exceeded the digit cap. As a result, entities such as &#x0000FEED; were left undecoded and passed to a simple startsWith('javascript:') test that failed to detect the malicious protocol. The unsafe string was then written directly to the server\u2011side rendered HTML, where browsers decode it natively and construct the blocked URI, allowing an attacker to execute arbitrary JavaScript in all browsers that load the page. This flaw has the same effect as a client\u2011side XSS flaw that can lead to session hijacking, data theft, or defacement.\n\nThe weakness is a classic case of CWE\u2011184: Unexpected Interpretation of Parameters, where malformed input bypasses validation logic.\n\nFrom the information supplied, the vulnerability does not allow direct server\u2011side code execution; its impact is confined to the client context, enabling attackers to run scripts in the browser.\n", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity, primarily because the attack requires the ability to inject content into the <head> area of a page. The EPSS score of less than 1% suggests a low probability of existing exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. However, because the flaw enables attackers to run arbitrary JavaScript in the browsers of all users who view the affected page, the potential damage can be substantial if the content is widely accessed. The likely attack vector is the insertion of specially crafted payloads that include leading\u2011zero padded entities through user\u2011controlled fields that are passed to useHeadSafe()."}}}}, "created": "2026-04-10T08:52:39.517271+00:00", "updated": "2026-04-15T16:00:07.802514+00:00", "vendors": ["unjs", "unjs$PRODUCT$unhead"]}