CVE-2026-31873 Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity
Attackers can bypass URI sanitization to inject malicious CSS, enabling UI redressing or data exfiltration in applications using Unhead.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31873?
CVE-2026-31873 is a cross-site scripting vulnerability in unjs unhead, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes('data:') returns false. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks. This vulnerability is fixed in 2.1.11.
Weakness: CWE-79
Which versions are affected by CVE-2026-31873?
2 open source packages ship an affected version, including unhead. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
unhead npm | All versions | 2.1.11 |
unhead npm | All versions | 2.1.11 |
Products include Unjs Unhead.
How do I fix CVE-2026-31873?
Upgrade unhead to 2.1.11 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-31873 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31873 exists.
Other vulnerabilities in unjs unhead
Sources
Also known as GHSA-5339-hvwr-7582.