@knowbl_ai/nexus-chat (1.0.0), @wistia/wistia-player (0.4.0) +2 more potentially affected by CVE-2026-22028 via preact (>=10.28.0, <=10.28.1)

preact NPM version =10.28.0, =10.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on preact and may be impacted: - @knowblai/nexus-chat 1.0.0 - @wistia/wistia-player 0.4.0 - @wistia/wistia-player-react 0.4.0 - astro-og 0.3.1 Source cves: CVE-2026-2202...

GHSA-36HM-QXXP-PG3M Preact has JSON VNode Injection issue

Impact Vulnerability Type: HTML Injection via JSON Type Confusion Affected Versions: Preact 10.26.5 through 10.28.1 Severity: Low to Medium see below Who is Impacted? Applications using affected Preact versions are vulnerable if they meet all of the following conditions: 1. Pass unmodified,...

Preact has JSON VNode Injection issue

Impact Vulnerability Type: HTML Injection via JSON Type Confusion Affected Versions: Preact 10.26.5 through 10.28.1 Severity: Low to Medium see below Who is Impacted? Applications using affected Preact versions are vulnerable if they meet all of the following conditions: 1. Pass unmodified,...

@clidey/dory (0.35.0), @garage44/bunchy (>=2.0.0, <=2.1.12) +15 more potentially affected by CVE-2026-22028 via preact (>=10.26.5, <=10.26.9)

preact NPM version =10.26.5, =2.0.0, =1.0.5, =3.0.0, =2.0.0, =19.0.0, =19.0.0, =19.0.0, =1.1.6, =5.14.0, =0.0.105, =0.0.105, =0.0.2, =0.0.109, =0.0.110 and more Source cves: CVE-2026-22028 Source advisory: SNYK:JS-PREACT-14897824...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.webjars.npm:preact is a fast 3kB alternative to React with the same modern API. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' during rendering in the vnode constructor. An attacker can inject arbitrary HTML or execute...

PT-2026-2136

Name of the Vulnerable Software and Affected Versions Preact versions 10.26.5 through 10.26.9 Preact versions 10.27.0 through 10.27.2 Preact versions 10.28.0 through 10.28.1 Description Preact, a lightweight web development framework, has an issue with JSON serialization protection. A regression...

Malicious code in preact-cli-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b97d147bbe2f906512da2cfa2de62ecc0c18b2afd14ceb1dfd755122300ea57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10769 Malicious code in preact-cli-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b97d147bbe2f906512da2cfa2de62ecc0c18b2afd14ceb1dfd755122300ea57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in preact-debug (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9776 Malicious code in preact-debug (npm)

--- -= Per source details. Do not edit below this line.=-...

GHSA-CG48-9HH2-X6MX HTML Injection in preact

Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input...

HTML Injection in preact

Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input...

Cross-site Scripting (XSS)

preact is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as it was possible to inject virtual-dom nodes through JSON injection...

HTML Injection

Overview Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires us...