6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39315

CVE-2026-39315: Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39315

CVE-2026-39315:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
unhead	npm	< 2.1.13	2.1.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the unhead library, specifically within the safe plugin utilized by the useHeadSafe() composable. The core issue is an incomplete HTML entity decoding mechanism in the decodeHtmlEntities function. The regular expressions responsible for identifying and decoding numeric HTML entities impose a fixed limit on the number of digits they can match. An attacker can exploit this by crafting an HTML entity with an excessive number of leading zeros, thereby exceeding the regex limit and preventing the entity from being decoded. This undecoded, malicious string is then passed to the hasDangerousProtocol function, which is designed to detect and block dangerous protocols such as javascript:. Because the malicious payload is not in its decoded form, the check is bypassed. Consequently, the unsanitized string is rendered directly into the HTML. The browser, upon parsing the HTML, decodes the entity and executes the embedded script, leading to a cross-site scripting (XSS) vulnerability. The patch addresses this by removing the digit limit from the regular expressions, which ensures that all numeric HTML entities are correctly decoded and subsequently sanitized.

Vulnerable functions

decodeHtmlEntities

packages/unhead/src/plugins/safe.ts

This function is responsible for decoding HTML entities. The vulnerability lies in this function where the regexes used for decoding have a fixed-width digit cap, which can be bypassed by using leading-zero padded HTML entities. This results in incomplete decoding of the input string, which is then passed to the `hasDangerousProtocol` function.

hasDangerousProtocol

packages/unhead/src/plugins/safe.ts

This function checks for dangerous protocols like `javascript:`. It is vulnerable because it relies on the output of `decodeHtmlEntities`. Due to the incomplete decoding in `decodeHtmlEntities`, this function can be bypassed, allowing dangerous protocols to be present in the output.

makeTagSafe

packages/unhead/src/plugins/safe.ts

This function is supposed to sanitize tags. It calls `hasDangerousProtocol` to check for dangerous protocols. Since `hasDangerousProtocol` can be bypassed, this function fails to properly sanitize the tags, leading to XSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.