Detections
Analytics

SCA: security update for unhead (GHSA-95h2-gj7x-gx9w)

medium Tenable Cloud Security Plugin ID 440135

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that
 Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely.
 Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML
 entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two
 regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros
 in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently
 skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match.
 makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the
 padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.
 (CVE-2026-39315)

Solution

Update the unhead library and its related packages to version 2.1.13 or later.

See Also

https://github.com/advisories/GHSA-95h2-gj7x-gx9w

Plugin Details

Severity: Medium

ID: 440135

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 4/10/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-39315

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/9/2026

Vulnerability Publication Date: 4/9/2026

Reference Information

CVE: CVE-2026-39315

cwe: CWE-184