WS-2019-0069

Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting...

PT-2020-21237

Name of the Vulnerable Software and Affected Versions preact versions prior to 10.0.0-beta.1 Description The issue is related to insufficient input validation, allowing attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This occurs when user input...

Cross-site Scripting (XSS)

preact is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as it was possible to inject virtual-dom nodes through JSON injection...