HTML Injection in preact

Description

Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with JSON.parse() to be passed directly into JSX without sanitization.

Recommendation

Update the preact package to the latest compatible version. Followings are version details:

• Affected version(s): >= 10.0.0-alpha.0, <= 10.0.0-beta.0
• Patched version(s): 10.0.0-beta.1

References

• GHSA-cg48-9hh2-x6mx
• medium.com
• www.npmjs.com
• CWE-74
• OWASP 2021-A3

Related Issues

• HTML Injection in marky-markdown - marky-markdown - Vulnerability
• HTML Injection in marky-markdown - Vulnerability
• HTML tag injection - Vulnerability
• XSS/HTML Injection Vulnerability in Umbraco Backoffice Components - CVE-2025-24012

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

preact