Unhead’s makeTagSafe (safe.ts) validates the `link.href` field by calling `String.includes()` on the scheme string. This method is case‑sensitive, whereas browsers treat URI schemes case‑insensitively. As a result, an attacker can inject a `DATA:` scheme with mixed case (e.g., `DATA:text/css,…`) that bypasses the check, allowing arbitrary CSS to be applied. The injected CSS may trigger UI redressing or data exfiltration through CSS attribute selectors and background‑image callbacks. This flaw is effectively a CSS‑based Cross‑Site Scripting vulnerability.

The affected product is unjs’unhead’. Versions prior to 2.1.11 are vulnerable, as the fix was introduced in 2.1.11.

The advisory lists an EPSS score of less than 1 % and the vulnerability is not in the CISA KEV catalog, indicating a low exploitation likelihood. Nevertheless, because the flaw enables injection of CSS that can modify page appearance or leak data, it could have serious impact if leveraged by an attacker. The vulnerability can be exploited from client‑side code that creates or modifies link tags, so the attack vector is browser‑based and requires the attacker to supply crafted markup to a vulnerable instance.