| Package | Affected versions | Patched versions |
|---|---|---|
| nuxt | ≥ 3.13.0, < 4.6.2 | 4.6.2 |
useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and <script> tags are only kept for JSON types.
When useHeadSafe is called inside a server island (a .server.vue component or page, or a component rendered with <NuxtIsland>), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. <NuxtIsland> then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.
As a result, input that useHeadSafe would normally strip (such as bodyAttrs.onload or executable <script> content) is rendered into the page. If an application passes user-controlled data to useHeadSafe inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.
<!-- components/AuthorMeta.server.vue -->
<script setup lang="ts">
const { data: author } = await useFetch('/api/author')
// author.value.head is user-authored, e.g. { bodyAttrs: { onload: '...' } }
useHeadSafe(author.value.head)
</script>
.server.vue component or page, or enables experimental.componentIslands and renders <NuxtIsland>.useHeadSafe inside a server island. useHeadSafe called from regular (non-island) components and pages is not affected.nuxt >=3.13.0, when head support for server islands was introduced. Nuxt 2 is not affected.
Fixed in [email protected]. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.
Patched releases apply Unhead's safe input filtering to useHeadSafe entries on the server before they are added to the island response, so islandResponse.head (including what render:island hooks see) only contains input that useHeadSafe allows.
Upgrade to [email protected]. If you cannot upgrade, including on Nuxt 3:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeuseHeadSafe with untrusted input from a regular component or page rather than from inside a server island.useHeadSafe inside a server island.