{"action":"Upgrade unhead to 2.1.11 or later.","affected":[{"fixed":"2.1.11","introduced":"0"}],"component":"unhead","cve_ids":["CVE-2026-31860"],"ecosystem":"npm","epss":0.00269,"exploited":false,"fixed_versions":["2.1.11"],"ghsa_id":"GHSA-g5xx-pwrp-g3fv","id":"tcs_01M5KFQ9DYRC0HT544NR00KKYK","modified_at":"2026-03-14T06:26:21.163867Z","published_at":"2026-03-12T14:19:15Z","references":["https://osv.dev/vulnerability/GHSA-g5xx-pwrp-g3fv","https://github.com/unjs/unhead/security/advisories/GHSA-g5xx-pwrp-g3fv","https://nvd.nist.gov/vuln/detail/CVE-2026-31860","https://github.com/unjs/unhead/commit/9ecc4f9568b0e23938f36d4b23fcfa4a18a89045","https://github.com/unjs/unhead","https://github.com/unjs/unhead/releases/tag/v2.1.11"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-g5xx-pwrp-g3fv","url":"https://osv.dev/vulnerability/GHSA-g5xx-pwrp-g3fv"},{"source":"nvd","source_id":"CVE-2026-31860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31860"}],"summary":"Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check"}