CVE-2026-31873: 
JavaScript vulnerability analysis and mitigation

CVE-2026-31873 is a Cross-Site Scripting (XSS) vulnerability in the unhead npm package (by unjs) caused by a bypass of URI scheme sanitization in the makeTagSafe function via case-sensitivity. It affects all versions up to and including 2.1.10, with the fix introduced in version 2.1.11. The vulnerability was published on March 12, 2026, and was reported by researcher simonkoeck. Feedly assigns it a CVSS v3.1 score of 6.1 (Medium), while the GitHub Advisory Database lists it as Low severity (Github Advisory, unhead Advisory).

The root cause (CWE-79) lies in makeTagSafe (safe.ts, lines 68–71), where link.href values are checked for dangerous URI schemes (javascript: and data:) using JavaScript's case-sensitive String.includes() method. Because browsers resolve URI schemes case-insensitively, an attacker can bypass the filter by supplying uppercase or mixed-case variants such as DATA:, JAVASCRIPT:, Data:, or dAtA:. The vulnerable code path is triggered when user-controlled input is passed to useHeadSafe(), which is intended to be the safe API for handling untrusted head tag data. The fix is to normalize the value to lowercase before performing the scheme check (Github Advisory, unhead Advisory).

Successful exploitation allows an unauthenticated attacker to inject arbitrary CSS or JavaScript into the rendered page by supplying a malicious href value with a case-variant URI scheme (e.g., DATA:text/css,body{display:none}). This can result in UI redressing (clickjacking-style attacks), data exfiltration via CSS attribute selectors with background-image callbacks, or execution of arbitrary JavaScript in the victim's browser context. Availability is not directly impacted, but confidentiality and integrity are both at low risk due to the scoped nature of the injection (Github Advisory, unhead Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the bypass with a direct call to useHeadSafe({ link: [{ rel: 'stylesheet', href: 'DATA:text/css,body{display:none}' }] }). No privileges are required, and the attack complexity is low, though user interaction is needed for the injected content to be rendered in a victim's browser. There is no evidence of in-the-wild exploitation at this time, and the EPSS score is approximately 0.03% (6th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, unhead Advisory).

1. Identify target: Locate a web application using unhead versions ≤ 2.1.10 that passes user-controlled input to the useHeadSafe() API (e.g., a Nuxt.js or Vue application with SSR).
2. Craft malicious payload: Construct a link.href value using an uppercase or mixed-case URI scheme to bypass the case-sensitive filter, for example: DATA:text/css,body{display:none} or JAVASCRIPT:alert(document.cookie).
3. Inject the payload: Supply the crafted value as the href attribute in a context where it will be processed by useHeadSafe(), such as through a user-controlled input field that populates head metadata.
4. Trigger rendering: The server-side rendered (SSR) output will include the unsanitized <link rel="stylesheet" href="DATA:text/css,..."> tag, which the browser loads as a valid stylesheet or script.
5. Achieve objective: The injected CSS can hide page elements (UI redressing), exfiltrate data via CSS attribute selectors with external background-image requests, or execute JavaScript if a javascript: scheme variant is used (Github Advisory, unhead Advisory).

• Network: Outbound HTTP requests from victim browsers to attacker-controlled domains triggered by CSS background-image or @import rules loaded via injected data: stylesheets; unusual external resource loads originating from inline data: URIs in page responses.
• Logs: Server-side rendering logs showing link tags with href values containing uppercase URI schemes (DATA:, JAVASCRIPT:, Data:, etc.) in SSR output; application logs reflecting unexpected useHeadSafe() inputs with non-standard URI scheme casing.
• File System / Response Content: HTML responses containing <link rel="stylesheet" href="DATA:..."> or <link href="JAVASCRIPT:..."> tags that were not present in the original template (Github Advisory).

Upgrade unhead to version 2.1.11 or later, which fixes the bypass by normalizing the href value to lowercase before performing the URI scheme check. As a temporary workaround if upgrading is not immediately possible, implement case-insensitive validation of URI schemes in any application-level input sanitization layer by converting values to lowercase before checking against blocked patterns. Applications using useHeadSafe() with untrusted user input should treat this as a priority upgrade (unhead Advisory, v2.1.11 Release).

The vulnerability was reported by researcher simonkoeck and published by unhead maintainer harlan-zw on March 12, 2026. The release notes for v2.1.11 note the security fix and advise users handling untrusted input with useHeadSafe to upgrade immediately. Coverage was picked up by automated CVE tracking feeds and security blogs shortly after disclosure, with no major controversy or widespread community discussion noted (v2.1.11 Release, Github Advisory).