https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:53:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-39315 <p><strong>Affected:</strong> unjs unhead</p> <p>Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt&#39;s own documentation explicitly recommends for rendering user-supplied content in &lt;head&gt; safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith(&#39;javascript:&#39;), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser&#39;s HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.</p> <p><strong>Affected:</strong> unjs unhead</p> <p>Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt&#39;s own documentation explicitly recommends for rendering user-supplied content in &lt;head&gt; safely. Internally, the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses two regular expressions with fixed-width digit caps. The HTML5 specification imposes no limit on leading zeros in numeric character references. When a padded entity exceeds the regex digit cap, the decoder silently skips it. The undecoded string is then passed to startsWith(&#39;javascript:&#39;), which does not match. makeTagSafe() writes the raw value directly into SSR HTML output. The browser&#39;s HTML parser decodes the padded entity natively and constructs the blocked URI. This vulnerability is fixed in 2.1.13.</p> https://cve.radiocsirt.org/vuln/cve-2026-39315