Packages / preact / Security

ModerateVulnerabilityGHSA-cg48-9hh2-x6mxPublished 2 Sep 2020

HTML Injection in preact

Affected · preact

  • >= 10.0.0-alpha.0, < 10.0.0-beta.1

Fixed in

10.0.0-beta.1

npm install preact@10.0.0-beta.1

  1. Not affected

    1.2.0 – 11.0.1

    238 releases, latest

238 stable releases of preact, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for preact. It is read in your browser and sent nowhere.

What happens

Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with JSON.parse() to be passed directly into JSX without sanitization.

Recommendation

Upgrade to version 10.0.0-beta.1.