CVE-2026-31873noneCWE-79

CVE-2026-31873: falha em unjs unhead

Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity

Publicada em

Seguir esta CVE+ Monitorar unhead+ Monitorar unhead

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 0epss 0.2%
Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes('data:') returns false. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks. This vulnerability is fixed in 2.1.11.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Produtos afetados
unjs · unhead
CVEs relacionadas — unjs unhead

No mesmo produto, das mais perigosas para as menos.

CVE-2026-39315MEDIUMUnhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()EPSS 0.3%CVE-2026-31860MEDIUMUnhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol checkEPSS 0.3%