{"id":"CVE-2026-39315","sourceIdentifier":"security-advisories@github.com","published":"2026-04-09T18:17:01.433","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13."},{"lang":"es","value":"Unhead es un gestor de cabeceras de documento y plantillas. Antes de la versión 2.1.13, useHeadSafe() es el composable que la propia documentación de Nuxt recomienda explícitamente para renderizar contenido proporcionado por el usuario en [head] de forma segura. Internamente, la función hasDangerousProtocol() en packages/unhead/src/plugins/safe.ts decodifica entidades HTML antes de verificar esquemas URI bloqueados (javascript_disabled: , data:, vbscript:). El decodificador utiliza dos expresiones regulares con límites de dígitos de ancho fijo. La especificación HTML5 no impone límite en los ceros iniciales en las referencias de caracteres numéricos. Cuando una entidad con relleno excede el límite de dígitos de la expresión regular, el decodificador la omite silenciosamente. La cadena sin decodificar se pasa entonces a startsWith(’javascript_disabled: ’), que no coincide. makeTagSafe() escribe el valor sin procesar directamente en la salida HTML SSR. El analizador HTML del navegador decodifica la entidad con relleno de forma nativa y construye el URI bloqueado. Esta vulnerabilidad se corrige en la versión 2.1.13."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"unjs","product":"unhead","versions":[{"version":"< 2.1.13","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-13T15:28:38.766188Z","id":"CVE-2026-39315","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:unjs:unhead:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2.1.13","matchCriteriaId":"2B95120E-BF74-4840-A52D-4D2499E8F958"}]}]}],"references":[{"url":"https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/unjs/unhead/releases/tag/v2.1.13","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}