HTML Injection in preact

Description

Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with JSON.parse() to be passed directly into JSX without sanitization.

Recommendation

Update the preact package to the latest compatible version. Followings are version details:

• Affected version(s): >= 10.0.0-alpha.0, <= 10.0.0-beta.0
• Patched version(s): 10.0.0-beta.1

References

• GHSA-cg48-9hh2-x6mx
• medium.com
• www.npmjs.com
• CWE-74
• OWASP 2021-A3

Related Issues

• Double spend in snarkjs - CVE-2023-33252
• SSRF & Credentials Leak - CVE-2023-49799
• Path Traversal in droppy - CVE-2020-7757
• Command Injection in dot - Vulnerability

Tags:

npm

preact