Description
Vulnerability Type: HTML Injection via JSON Type Confusion
Affected Versions: Preact 10.26.5 through 10.28.1
Severity: Low to Medium (see below)
Recommendation
Update the preact package to the latest compatible version. Followings are version details:
Affected version(s): **>= 10.28.0, < 10.28.2 >= 10.27.0, < 10.27.3 >= 10.26.5, < 10.26.10** Patched version(s): **10.28.2 10.27.3 10.26.10**
References
Could your website be exposed too?
SmartScanner can check your website for Preact has JSON VNode Injection issue and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters - CVE-2026-25544
- degit has a Command Injection issue - CVE-2026-11572
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
- Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options - CVE-2026-33941
You might also like:
See something that needs correcting? Let us knowUpdated January 08, 2026