GHSA-xfq5-w38q-pc2x Nuxt server islands render `useHeadSafe` input without sanitisation

• npm nuxt: >= 3.13.0, < 4.6.2 → fixed in 4.6.2

Impact `useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `` tags are only kept for JSON types. When `useHeadSafe` is called inside a server island (a `.server.vue` component or page, or a component rendered with ``), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. `` then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client. As a result, input that `useHeadSafe` would normally strip (such as `bodyAttrs.onload` or executable `` content) is rendered into the page. If an application passes user-controlled data to `useHeadSafe` inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin. ```vue const { data: author } = await useFetch('/api/author') // author.value.head is user-authored, e.g. { bodyAttrs: { onload: '...' } } useHeadSafe(author.value.head) ``` Mitigating factors • Server components are experimental. They are only active when the application defines a `.server.vue` component or page, or enables `experimental.componentIslands` and renders ``. • Exploitation requires the application to pass attacker-controlled data to `useHeadSafe` inside a server island. `useHeadSafe` called from regular (non-island) components and pages is not affected. Affected versions `nuxt` `>=3.13.0`, when head support for server islands was introduced. Nuxt 2 is not affected. Patches Fixed in `[email protected]`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix. Patched releases apply Unhead's safe input filtering to `useHeadSafe` entries on the server before they are added to the island response, so `islandResponse.head` (including what `render:island` hooks see) only contains input that `useHeadSafe` allows. Workarounds Upgrade to `[email protected]`. If you cannot upgrade, including on Nuxt 3: 1. Call `useHeadSafe` with untrusted input from a regular component or page rather than from inside a server island. 2. Alternatively, validate untrusted head input against your own allowlist before passing it to `useHeadSafe` inside a server island.