[Low][ssr] head titleTemplate uses String.replace — $&/$1 in title mangle output #177

Severity: 🟢 Low (correctness — not exploitable)

Location

src/ssr/head.ts:114-117.

Description

titleTemplate is applied with:

state.titleTemplate.replace(/%s/g, state.title)

Because state.title is used as the replacement string, special replacement patterns ($&, $1, $', $`) in the title are interpreted by String.prototype.replace and mangle the output. Not a security issue (the result is escapeText'd before emission), but a correctness bug — e.g. a page titled Q&A $& more renders incorrectly.

Suggested fix

Use a replacer function so the title is inserted literally:

state.titleTemplate.replace(/%s/g, () => state.title)

Filed as part of a full-codebase security & correctness audit.