https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 17:28:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275836 EUVD-2026-275836 https://cve.radiocsirt.org/vuln/euvd-2026-275836 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31873 <p>Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but &#39;DATA:...&#39;.includes(&#39;data:&#39;) returns false. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks. This vulnerability is fixed in 2.1.11.</p> <p>Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses String.includes(), which is case-sensitive. Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but &#39;DATA:...&#39;.includes(&#39;data:&#39;) returns false. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks. This vulnerability is fixed in 2.1.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-31873 https://cve.radiocsirt.org/vuln/ghsa-5339-hvwr-7582 <p><strong>Affected:</strong> npm: unhead</p> <p>The `link.href` check in `makeTagSafe` (safe.ts, line 68-71) uses `String.includes()`, which is case-sensitive:</p> <p>```typescript if (key === &#39;href&#39;) { if (val.includes(&#39;javascript:&#39;) || val.includes(&#39;data:&#39;)) { return } next[key] = val } ```</p> <p>Browsers treat URI schemes case-insensitively. `DATA:text/css,...` is the same as `data:text/css,...` to the browser, but `&#39;DATA:...&#39;.includes(&#39;data:&#39;)` returns `false`.</p> <p>### PoC</p> <p>```javascript useHeadSafe({ link: [{ rel: &#39;stylesheet&#39;, href: &#39;DATA:text/css,body{display:none}&#39; }] }) ```</p> <p>SSR output:</p> <p>```html &lt;link rel=&#34;stylesheet&#34; href=&#34;DATA:text/css,body{display:none}&#34;&gt; ```</p> <p>The browser loads this as a CSS stylesheet. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks.</p> <p>Any case variation works: `DATA:`, `Data:`, `dAtA:`, `JAVASCRIPT:`, etc.</p> <p>## Suggested fix</p> <p>```typescript if (key === &#39;href&#39;) { const lower = val.toLowerCase() if (lower.includes(&#39;javascript:&#39;) || lower.includes(&#39;data:&#39;)) { return } next[key] = val } ```</p> <p><strong>Affected:</strong> npm: unhead</p> <p>The `link.href` check in `makeTagSafe` (safe.ts, line 68-71) uses `String.includes()`, which is case-sensitive:</p> <p>```typescript if (key === &#39;href&#39;) { if (val.includes(&#39;javascript:&#39;) || val.includes(&#39;data:&#39;)) { return } next[key] = val } ```</p> <p>Browsers treat URI schemes case-insensitively. `DATA:text/css,...` is the same as `data:text/css,...` to the browser, but `&#39;DATA:...&#39;.includes(&#39;data:&#39;)` returns `false`.</p> <p>### PoC</p> <p>```javascript useHeadSafe({ link: [{ rel: &#39;stylesheet&#39;, href: &#39;DATA:text/css,body{display:none}&#39; }] }) ```</p> <p>SSR output:</p> <p>```html &lt;link rel=&#34;stylesheet&#34; href=&#34;DATA:text/css,body{display:none}&#34;&gt; ```</p> <p>The browser loads this as a CSS stylesheet. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks.</p> <p>Any case variation works: `DATA:`, `Data:`, `dAtA:`, `JAVASCRIPT:`, etc.</p> <p>## Suggested fix</p> <p>```typescript if (key === &#39;href&#39;) { const lower = val.toLowerCase() if (lower.includes(&#39;javascript:&#39;) || lower.includes(&#39;data:&#39;)) { return } next[key] = val } ```</p> https://cve.radiocsirt.org/vuln/ghsa-5339-hvwr-7582