What’s Vulnerable › Vulnerabilities
CVE-2026-31873: Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-12 · updated 2026-06-17
- Weakness: CWE-79
Description
Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes('data:') returns false. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks. This vulnerability is fixed in 2.1.11.
Affected products
- unjs unhead: before 2.1.11 — fixed in 2.1.11
How to fix
Upgrade to a fixed version: unjs unhead 2.1.11. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-31873 or the next vulnerability affects your stack