EUVD-2026-20992
GHSA-95h2-gj7x-gx9w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4Blast Radius
ecosystem impact- 6 npm packages depend on unhead (6 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.1.13.
DescriptionGitHub Advisory
Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.
AnalysisAI
Unhead's useHeadSafe() composable, explicitly recommended by Nuxt documentation for safely rendering user-supplied content in document head, can be bypassed via padded HTML numeric character references that exceed regex digit limits. The hasDangerousProtocol() function silently fails to decode these entities, allowing blocked URI schemes (javascript:, data:, vbscript:) to pass validation; browsers then natively decode the padded entity during HTML parsing, enabling cross-site scripting (XSS) attacks. This affects Unhead versions prior to 2.1.13, with no confirmed active exploitation or public exploit code identified at time of analysis.
Technical ContextAI
Unhead is a head and template management library used by Nuxt applications. The vulnerability exploits a mismatch between server-side entity decoding logic and browser-side HTML parsing. The hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts uses fixed-width regex digit caps to decode HTML numeric character references (both decimal and hexadecimal), but the HTML5 specification permits unlimited leading zeros in these references (e.g., javascript:). When a padded entity exceeds the regex digit cap, the decoder silently returns the original string unchanged. The makeTagSafe() function then writes this undecoded string directly into SSR HTML output. The browser's native HTML parser later decodes the padded entity according to HTML5 rules and constructs the dangerous URI, bypassing the server-side check. This is a classic encoding-validation bypass (CWE-184: Incomplete List of Disallowed Inputs).
RemediationAI
Vendor-released patch: Upgrade to Unhead version 2.1.13 or later. This version corrects the hasDangerousProtocol() function to properly handle padded numeric character references with unlimited leading zeros. The fix is available at https://github.com/unjs/unhead/releases/tag/v2.1.13. For Nuxt applications, update the unhead dependency in package.json to >=2.1.13 and reinstall dependencies. No workaround is available for earlier versions; patching is the recommended remediation. The upstream fix is documented in commit 961ea781e091853812ffe17f8cda17105d2d2299 at https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299.
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today