HTML Injection in preact

Description

Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with JSON.parse() to be passed directly into JSX without sanitization.

Recommendation

Update the preact package to the latest compatible version. Followings are version details:

• Affected version(s): >= 10.0.0-alpha.0, <= 10.0.0-beta.0
• Patched version(s): 10.0.0-beta.1

References

• GHSA-cg48-9hh2-x6mx
• medium.com
• www.npmjs.com
• CWE-74
• OWASP 2021-A3

Related Issues

• systeminformation SSID Command Injection Vulnerability - CVE-2023-42810
• Phishing attack vulnerability by uploading malicious HTML file - CVE-2023-32689
• Command Injection in marsdb - Vulnerability
• CouchAuth host header injection vulnerability leaks the password reset token - CVE-2023-39655

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

preact