Description
Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt-s own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith(-javascript:-), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser-s HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.
- Publication
- 2026-04-09 18:17:01
- Versions concernées
- <2.1.13
- Type
- Package
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N