HTML Injection in preact
Summary
GHSA-cg48-9hh2-x6mx: HTML Injection in preact. Affects preact versions >= 10.0.0-alpha.0, < 10.0.0-beta.1. Fixed in 10.0.0-beta.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Preact is a fast and lightweight JavaScript library for building user interfaces. It is often used as an alternative to React due to its smaller size and faster performance. Preact allows developers to create virtual DOM nodes and render them efficiently. However, versions of Preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection.
Vulnerability Detail
The vulnerability in Preact arises from insufficient input validation. Attackers can exploit this vulnerability by injecting JavaScript objects as virtual DOM nodes, which can lead to Cross-Site Scripting (XSS) attacks. This vulnerability specifically affects user input parsed with JSON.parse() that is passed directly into JSX without proper sanitization.
How To Fix
Minimum fixed version
10.0.0-beta.1
This is the first release that contains the fix.
npm install preact@10.0.0-beta.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The HTML Injection vulnerability in preact can lead to Cross-Site Scripting (XSS) attacks. It is crucial for developers to upgrade to version 10.0.0-beta.1 of Preact to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for preact →
FAQ
Preact is a JavaScript library for building user interfaces. It is similar to React but has a smaller size and faster performance.
HTML Injection is a type of vulnerability where an attacker can inject malicious HTML code into a web page. This can lead to Cross-Site Scripting (XSS) attacks and other security issues.
The vulnerability in Preact occurs due to insufficient input validation. Attackers can inject JavaScript objects as virtual DOM nodes, which can result in HTML Injection and potential XSS attacks.
Cross-Site Scripting (XSS) is a type of security vulnerability where attackers inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, and other malicious activities.
To protect your application from this vulnerability, it is recommended to upgrade to the fixed version of Preact (10.0.0-beta.1). Additionally, ensure that user input parsed with JSON.parse() is properly sanitized before being passed into JSX.
References
Related vulnerabilities
Recent vulnerabilities recorded for preact.
