Npm/Unhead | GitLab Advisory Database

Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity

The link.href check in makeTagSafe (safe.ts, line 68-71) uses String.includes(), which is case-sensitive: if (key === 'href') { if (val.includes('javascript:') || val.includes('data:')) { return } next[key] = val } Browsers treat URI schemes case-insensitively. DATA:text/css,… is the same as data:text/css,… to the browser, but 'DATA:…'.includes('data:') returns false.

Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for safely handling user-generated content.

Advisories for Npm/Unhead package