CVE-2026-39315

OVERVIEW CVE-2026-39315 affects Unhead, a document head and template manager used by Nuxt applications, in versions prior to 2.1.13. The vulnerability exists in the useHeadSafe() composable, which Nuxt's documentation recommends for safely rendering user-supplied content in the HTML head section. A flaw in the hasDangerousProtocol() function fails to properly sanitize HTML entities with padded numeric character references, allowing attackers to bypass URI scheme restrictions and inject malicious javascript:, data:, or vbscript: URIs. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.1 (Medium) with a network-based attack vector requiring no special privileges or authentication, though user interaction is necessary. The attack has low complexity and results in compromised confidentiality and integrity while avoiding system availability impact. The scope changes across trust boundaries, meaning the vulnerability could affect resources beyond the vulnerable component itself. The FAUCET Risk Score of 43.0/100 reflects moderate concern within the vulnerability landscape. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 0.0006 indicates negligible probability of exploitation. No public exploit code is currently available, and community attention appears limited. Organizations should prioritize patching to version 2.1.13 to mitigate potential risk, particularly if user-controlled content is rendered in document head sections.