## Nuxt server islands render `useHeadSafe` input without sanitisation

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs, nuxt, vue
- CVE: CVE-2026-114133
- 公開日時: 2026-10-22T16:58:00.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-xfq5-w38q-pc2x)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-xfq5-w38q-pc2x

影響: npm:nuxt >= 3.13.0, < 4.6.2 → 4.6.2
useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and Mitigating factors - Server components are experimental. They are only active when the application defines a .server.vue component or page, or enables experimental.componentIslands and renders . - Exploitation requires the application to pass attacker-controlled data to useHeadSafe inside a server island. useHeadSafe called…