Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

preact

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.2npmAmendedPublished

    Preact has JSON VNode Injection issue

    CVE-2026-22028 · GHSA-36hm-qxxp-pg3m

    Affected
    • npm preact >= 10.26.5, < 10.26.10; >= 10.27.0, < 10.27.3; >= 10.28.0, < 10.28.2
    Fixed in
    10.28.210.27.310.26.10· Vendor fix available
    Issue
    Impact Vulnerability Type: HTML Injection via JSON Type Confusion Affected Versions: Preact 10.26.5 through 10.28.1 Severity: Low to Medium (see below) Who is Impacted? Applications using affected Preact versions are vulnerable if they meet all of the following conditions: 1. Pass unmodified, unsanitized values from user-modifiable data sources (APIs, databases, local storage, etc.) directly into the render tree 2. Assume these values are strings but the data source could return actual JavaScript objects instead of JSON strings 3. The data source either: - Fails to perform type sanitization AND blindly stores/returns raw objects interchangeably with strings, OR - Is compromised (e.g., poisoned local storage, filesystem, or database) Technical Details Preact includes JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from…

    Recommended action: Upgrade to 10.28.2, 10.27.3 or 10.26.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. UnratednpmAmendedPublished

    HTML Injection in preact

    GHSA-cg48-9hh2-x6mx

    Affected
    • npm preact >= 10.0.0-alpha.0, <= 10.0.0-beta.0
    Fixed in
    10.0.0-beta.1· Vendor fix available
    Issue
    Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with JSON.parse() to be passed directly into JSX without sanitization. Recommendation Upgrade to version 10.0.0-beta.1.

    Recommended action: Upgrade to 10.0.0-beta.1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →