{"id":"ghsa-ghsa-xfq5-w38q-pc2x","seq":309550,"kind":"advisory","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x","permalink":"https://vulnpulse.app/items/ghsa-ghsa-xfq5-w38q-pc2x","summary":"影響: npm:nuxt >= 3.13.0, < 4.6.2 → 4.6.2\nuseHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and Mitigating factors - Server components are experimental. They are only active when the application defines a .server.vue component or page, or enables experimental.componentIslands and renders . - Exploitation requires the application to pass attacker-controlled data to useHeadSafe inside a server island. useHeadSafe called…","severity":"medium","techs":["nodejs","nuxt","vue"],"cves":["CVE-2026-114133"],"tags":["GHSA-xfq5-w38q-pc2x","nuxt"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:58:00.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}