# GHSA-x7mm-9vvv-64w8: unhead: Streaming SSR `streamKey` injected into inline script without identifier validation

> An XSS vulnerability in unhead allows script injection if developers improperly pass untrusted data to the streamKey configuration option.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Apr 2026

## What is GHSA-x7mm-9vvv-64w8?

GHSA-x7mm-9vvv-64w8 is a cross-site scripting vulnerability in unhead, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Summary

`createStreamableHead({ streamKey })` interpolated its `streamKey` argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application forwards untrusted data into that configuration value, the rendered scripts become a script-injection sink.

### Details

`streamKey` was embedded into JavaScript source via dot notation in two public helpers:

* `createBootstrapScript()` returned `<script>window.${streamKey}={...}</script>`
* `renderSSRHeadSuspenseChunk()` returned `window.${streamKey}.push(...)`

No escaping, quoting, or identifier validation was applied before these strings were embedded into HTML. A `streamKey` such as `__unhead__;globalThis.PWNED=1;//` broke out of the intended property access and injected arbitrary JavaScript into the page. The JSON escaping used for streamed head entries did not protect `streamKey` because `streamKey` was inserted as raw code rather than as serialized data.

### Impact

`streamKey` is a developer-chosen configuration value rather than a data field — the intended usage is a hardcoded identifier-shaped constant (default `__unhead__`). Exploitation therefore requires an application to explicitly route untrusted input into a configuration sink, which is not a documented or recommended pattern. We have no reports of any downstream project sourcing `streamKey` from request data.

Applications using the default `streamKey`, or any hardcoded custom key, are **not affected**.

### PoC

```ts
import { createStreamableHead, renderSSRHeadShell } from 'unhead/stream/server'

const { head } = createStreamableHead({
  streamKey: '__unhead__;globalThis.PWNED=1;//',
})

const html = renderSSRHeadShell(
  head,
  '<!doctype html><html><head></head><body></body></html>',
)

// <!doctype html><html><head><script>window.__unhead__;globalThis.PWNED=1;//={_q:[],push(e){this._q.push(e)}}</script>…
```

### Patch

Fixed on `main` in [`64b5ac0`](https://github.com/unjs/unhead/commit/64b5ac0aa30cc256ea6677ce3dc4f132f81b2ff6). The fix will ship in the next patch release of `unhead`.

`streamKey` is now validated against a conservative ASCII JavaScript-identifier pattern (`/^[$_a-z][$\w]*$/i`) at every sink — `createStreamableHead`, `createBootstrapScript`, and the internal stream-key resolver. Invalid values throw immediately instead of being emitted into script output.

### Workarounds

Do not pass untrusted data into `createStreamableHead({ streamKey })` or `createBootstrapScript(key)`. If per-tenant keys are required, whitelist them against an identifier-safe pattern before constructing the head instance.

### Credit

Thanks to @Jvr2022 for the report.

## Which versions are affected by GHSA-x7mm-9vvv-64w8?

2 open source packages ship an affected version, including unhead.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `unhead` | npm | From 3.0.0-beta.5 | 3.0.1 |
| `unhead` | npm | From 3.0.0-beta.5 | 3.0.1 |

## How do I fix GHSA-x7mm-9vvv-64w8?

Upgrade unhead to 3.0.1 or later.

## Is GHSA-x7mm-9vvv-64w8 being exploited?

There is no known exploitation of GHSA-x7mm-9vvv-64w8 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-x7mm-9vvv-64w8 and fix it if it is affected.

What it is: GHSA-x7mm-9vvv-64w8 is a cross-site scripting vulnerability in unhead, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-x7mm-9vvv-64w8 in the wild and no public exploit code.

Affected packages and fixed versions:
- unhead (npm): affected from 3.0.0-beta.5; fixed in 3.0.1
- unhead (npm): affected from 3.0.0-beta.5; fixed in 3.0.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-x7mm-9vvv-64w8/ (Markdown: https://insights.sbomify.com/GHSA-x7mm-9vvv-64w8/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-x7mm-9vvv-64w8

---
From sbomify Insights: https://insights.sbomify.com/GHSA-x7mm-9vvv-64w8/
Summaries are generated and may contain mistakes; the official description above is the record.