Executive brief
Unhead is a library used by developers to manage the <head> section of web pages, particularly in server-side rendered applications. A vulnerability exists where a configuration setting called 'streamKey' can be used to inject malicious scripts into the page if it is populated with untrusted data. While this setting is typically a fixed constant, an exploit could allow an attacker to execute unauthorized code in a user's browser, potentially leading to data theft or session hijacking.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Unhead's streaming Server-Side Rendering (SSR) helpers, specifically 'createBootstrapScript' and 'renderSSRHeadSuspenseChunk'. The 'streamKey' argument is interpolated directly into JavaScript source code via dot notation without escaping or identifier validation. An attacker who can influence this configuration value can break out of the intended property access (e.g., using a payload like '__unhead__;globalThis.PWNED=1;//') to execute arbitrary JavaScript. The vulnerability is mitigated by the fact that 'streamKey' is intended to be a developer-defined constant, but it becomes a risk if applications dynamically source this value from untrusted input. A fix has been implemented in version 3.0.1 which enforces a strict ASCII identifier regex.
Affected products
- unjs unhead >= 3.0.0-beta.5, <= 3.0.0
Timeline
- 2026-04-10: advisory: GHSA-x7mm-9vvv-64w8 published
- 2026-04-10: patched: Fixed in version 3.0.1