# CVE-2026-31860: Unhead useHeadSafe XSS bypass via attribute name injection

Source: https://junglewise.ai/threats/cve-2026-31860-unhead-useheadsafe-xss-bypass-via-attribute-name-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-31860 · Severity: medium · CVSS 4 · Published 2026-03-12

Unhead is a library used to manage HTML head tags in server-side rendered web applications. The useHeadSafe function, which is recommended by Nuxt documentation for safely handling user-generated metadata, can be bypassed to inject arbitrary HTML event handlers (such as onload) into rendered pages. An attacker who controls SEO metadata or user profile fields could inject malicious code that executes when a page is loaded, potentially stealing session credentials or performing actions on behalf of users.

Technologies: [unhead (npm)](https://junglewise.ai/threats/technologies/unhead). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-31860 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31860 being exploited in the wild.

**How severe is CVE-2026-31860?** Medium severity, with a CVSS score of 4, published 12 March 2026.

**Which products and versions are affected?** unhead (npm) SEMVER:introduced=0,fixed=2.1.11.

**Is there a fix for CVE-2026-31860?** Yes. unhead (npm): upgrade to 2.1.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-31860 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-31860?** Check whether you run unhead (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- unhead (npm): upgrade to 2.1.11 or later

  ```sh
  npm install unhead@2.1.11
  ```


## Technical details

The vulnerability is a Cross-Site Scripting (XSS) flaw in the acceptDataAttrs function (CWE-79), which validates data-* attribute names but only checks the prefix, not whether the key contains spaces or other invalid HTML attribute characters. When attribute keys containing spaces and event handlers (e.g., "data-x onload=alert(1) y") are passed to useHeadSafe, they are interpolated directly into HTML without sanitization, allowing the injected event handler to be parsed as a separate HTML attribute. The attack is reliable when injected into link tags with rel="stylesheet" because the onload event fires once the stylesheet loads. No authentication is required; the attack is network-reachable and depends on user interaction (page load). The vulnerability was patched in version 2.1.11 with a regex validation to ensure attribute names contain only legal HTML attribute characters.

## Affected products

- unjs Unhead <= 2.1.10

## Identifiers

- CVE-2026-31860
- GHSA-g5xx-pwrp-g3fv

## Timeline

- 2026-03-12: disclosed
- 2026-03-12: patched: Version 2.1.11 released with regex validation fix

## References

- [https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv](https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv)

## Related threats

- [unhead streaming SSR streamKey script injection](https://junglewise.ai/threats/unhead-streaming-ssr-streamkey-script-injection-7d041c56)
- [Unhead hasDangerousProtocol bypass via padded HTML entities](https://junglewise.ai/threats/cve-2026-39315-unhead-hasdangerousprotocol-bypass-via-padded-html-entities)
- [Unhead URI scheme sanitization bypass via case-sensitivity](https://junglewise.ai/threats/cve-2026-31873-unhead-uri-scheme-sanitization-bypass-via-case-sensitivity)