{"answers":{"affected":"2 open source packages ship an affected version, including unhead.","exploited":"There is no known exploitation of GHSA-x7mm-9vvv-64w8 in the wild and no public exploit code.","fix":"Upgrade unhead to 3.0.1 or later.","what":"GHSA-x7mm-9vvv-64w8 is a cross-site scripting vulnerability in unhead, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-x7mm-9vvv-64w8 and fix it if it is affected.\n\nWhat it is: GHSA-x7mm-9vvv-64w8 is a cross-site scripting vulnerability in unhead, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-x7mm-9vvv-64w8 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- unhead (npm): affected from 3.0.0-beta.5; fixed in 3.0.1\n- unhead (npm): affected from 3.0.0-beta.5; fixed in 3.0.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-x7mm-9vvv-64w8/ (Markdown: https://insights.sbomify.com/GHSA-x7mm-9vvv-64w8/index.md)","id":"GHSA-x7mm-9vvv-64w8","markdown":"https://insights.sbomify.com/GHSA-x7mm-9vvv-64w8/index.md","name":"GHSA-x7mm-9vvv-64w8","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"JavaScript SSR library","requires_auth":"none","summary":"An XSS vulnerability in unhead allows script injection if developers improperly pass untrusted data to the streamKey configuration option.","user_interaction":"not_required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\n`createStreamableHead({ streamKey })` interpolated its `streamKey` argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application forwards untrusted data into that configuration value, the rendered scripts become a script-injection sink.\n\n### Details\n\n`streamKey` was embedded into JavaScript source via dot notation in two public helpers:\n\n* `createBootstrapScript()` returned `\u003cscript\u003ewindow.${streamKey}={...}\u003c/script\u003e`\n* `renderSSRHeadSuspenseChunk()` returned `window.${streamKey}.push(...)`\n\nNo escaping, quoting, or identifier validation was applied before these strings were embedded into HTML. A `streamKey` such as `__unhead__;globalThis.PWNED=1;//` broke out of the intended property access and injected arbitrary JavaScript into the page. The JSON escaping used for streamed head entries did not protect `streamKey` because `streamKey` was inserted as raw code rather than as serialized data.\n\n### Impact\n\n`streamKey` is a developer-chosen configuration value rather than a data field — the intended usage is a hardcoded identifier-shaped constant (default `__unhead__`). Exploitation therefore requires an application to explicitly route untrusted input into a configuration sink, which is not a documented or recommended pattern. We have no reports of any downstream project sourcing `streamKey` from request data.\n\nApplications using the default `streamKey`, or any hardcoded custom key, are **not affected**.\n\n### PoC\n\n```ts\nimport { createStreamableHead, renderSSRHeadShell } from 'unhead/stream/server'\n\nconst { head } = createStreamableHead({\n  streamKey: '__unhead__;globalThis.PWNED=1;//',\n})\n\nconst html = renderSSRHeadShell(\n  head,\n  '\u003c!doctype html\u003e\u003chtml\u003e\u003chead\u003e\u003c/head\u003e\u003cbody\u003e\u003c/body\u003e\u003c/html\u003e',\n)\n\n// \u003c!doctype html\u003e\u003chtml\u003e\u003chead\u003e\u003cscript\u003ewindow.__unhead__;globalThis.PWNED=1;//={_q:[],push(e){this._q.push(e)}}\u003c/script\u003e…\n```\n\n### Patch\n\nFixed on `main` in [`64b5ac0`](https://github.com/unjs/unhead/commit/64b5ac0aa30cc256ea6677ce3dc4f132f81b2ff6). The fix will ship in the next patch release of `unhead`.\n\n`streamKey` is now validated against a conservative ASCII JavaScript-identifier pattern (`/^[$_a-z][$\\w]*$/i`) at every sink — `createStreamableHead`, `createBootstrapScript`, and the internal stream-key resolver. Invalid values throw immediately instead of being emitted into script output.\n\n### Workarounds\n\nDo not pass untrusted data into `createStreamableHead({ streamKey })` or `createBootstrapScript(key)`. If per-tenant keys are required, whitelist them against an identifier-safe pattern before constructing the head instance.\n\n### Credit\n\nThanks to @Jvr2022 for the report.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"unhead: Streaming SSR `streamKey` injected into inline script without identifier validation","id":"GHSA-x7mm-9vvv-64w8","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["3.0.1"],"introduced":["3.0.0-beta.5"],"last_affected":[],"package":"unhead","purl":null,"source":"GHSA-x7mm-9vvv-64w8"},{"ecosystem":"npm","fixed":["3.0.1"],"introduced":["3.0.0-beta.5"],"last_affected":[],"package":"unhead","purl":"pkg:npm/unhead","source":"GHSA-x7mm-9vvv-64w8"}],"products":null,"published":"2026-04-10","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An XSS vulnerability in unhead allows script injection if developers improperly pass untrusted data to the streamKey configuration option.","url":"https://insights.sbomify.com/GHSA-x7mm-9vvv-64w8/"}