GitHub Advisoryadvisory · npm

GHSA-cg48-9hh2-x6mx HTML Injection in preact

MEDIUM Published 2020-09-02 Modified 2021-09-27 Official page ↗
Ecosystem
npm
Packages
preact
Severity
Moderate
Weaknesses
CWE-74
Reviewed
2020-08-31

Affected packages

• npm preact: >= 10.0.0-alpha.0, < 10.0.0-beta.1 → fixed in 10.0.0-beta.1

Description

Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with `JSON.parse()` to be passed directly into JSX without sanitization. Recommendation Upgrade to version 10.0.0-beta.1.

Related

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References