Nuxt · NUXT0056
Use useHeadSafe for untrusted head values
Finds Nuxt security code that should use the supported useheadsafe for untrusted values pattern instead.
nuxt/security/prefer-useheadsafe-for-untrusted-valuessrc/rule-packs/nuxt/rules/nuxt/prefer-use-head-safe-for-untrusted-values.ts Upstream docs Run this rule
pnpm nuxt doctor --rules nuxt/security/prefer-useheadsafe-for-untrusted-values
Why it matters
Values derived from routes, content, or users can inject unsafe head attributes when passed through unrestricted useHead().
Recommended fix
Use the Nuxt-supported useheadsafe for untrusted values pattern instead.
Useful links
Example
Use useHeadSafe for untrusted values
Before
const route = useRoute()
useHead({
title: route.query.title as string,
})
After
const route = useRoute()
useHeadSafe({
title: route.query.title as string,
})