{"id":"GHSA-cg48-9hh2-x6mx","aliases":[],"status":"published","title":"HTML Injection in preact","description":"Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with `JSON.parse()` to be passed directly into JSX without sanitization.\n\n\n## Recommendation\n\nUpgrade to version 10.0.0-beta.1.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2020-09-02T18:28:58Z","modified":"2023-01-09T05:03:46Z","fixes":[{"ecosystem":"npm","package":"preact","fixed_in":["10.0.0-beta.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"preact","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-alpha.0"},{"last_affected":"10.0.0-beta.0"},{"fixed":"10.0.0-beta.1"}]}]},{"source":"osv","ecosystem":"npm","package":"preact","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0-alpha.0"},{"fixed":"10.0.0-beta.1"}]}]}],"references":[{"url":"https://github.com/developit/preact/pull/1528","tags":["web"]},{"url":"https://github.com/developit/preact/releases/tag/10.0.0-beta.1","tags":["web"]},{"url":"https://medium.com/dailyjs/exploiting-script-injection-flaws-in-reactjs-883fb1fe36c1","tags":["web"]},{"url":"https://www.npmjs.com/advisories/835","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cg48-9hh2-x6mx"},{"url":"https://github.com/developit/preact","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-cg48-9hh2-x6mx","title":"HTML Injection in preact","description":"Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with `JSON.parse()` to be passed directly into JSX without sanitization.\n\n\n## Recommendation\n\nUpgrade to version 10.0.0-beta.1.","status":"published","published":"2020-09-02T18:28:58Z","modified":"2023-01-09T05:03:46Z","cwes":["CWE-74"],"updated_at":"2026-11-02T14:36:06.317379Z"}],"osv":[{"id":"GHSA-cg48-9hh2-x6mx","title":"HTML Injection in preact","description":"Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with `JSON.parse()` to be passed directly into JSX without sanitization.\n\n\n## Recommendation\n\nUpgrade to version 10.0.0-beta.1.","status":"published","published":"2020-09-02T18:28:58Z","modified":"2021-09-27T20:53:56Z","cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}