HTML Injection in preact

Description

Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with JSON.parse() to be passed directly into JSX without sanitization.

Recommendation

Update the preact package to the latest compatible version. Followings are version details:

• Affected version(s): >= 10.0.0-alpha.0, <= 10.0.0-beta.0
• Patched version(s): 10.0.0-beta.1

References

• GHSA-cg48-9hh2-x6mx
• medium.com
• www.npmjs.com
• CWE-74
• OWASP 2021-A3

Related Issues

• systeminformation command injection vulnerability - CVE-2020-7752
• systeminformation SSID Command Injection Vulnerability - CVE-2023-42810
• Phishing attack vulnerability by uploading malicious HTML file - CVE-2023-32689
• FUXA SQL Injection vulnerability (GHSA-p46g-8c3q-89p2) - CVE-2023-31719

Tags:

npm

preact