WS-2019-0069

Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting...

Type Confusion

Preact is vulnerable to Type Confusion. The vulnerability is due to weakened JSON serialization protections that allow specially crafted JSON objects to be treated as valid Virtual DOM nodes, which allows an attacker to inject malicious HTML or scripts when untrusted data is rendered without prop...

PT-2020-21237

Name of the Vulnerable Software and Affected Versions preact versions prior to 10.0.0-beta.1 Description The issue is related to insufficient input validation, allowing attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This occurs when user input...

Cross-site Scripting (XSS)

preact is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as it was possible to inject virtual-dom nodes through JSON injection...