Skip to content
OpenAdvisories

Package · npm

preact

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.2
    CVE-2026-22028

    Preact has JSON VNode Injection issue

    Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where v…

    preactjs preact preact node-preact Ubuntu npm
  • Medium —
    GHSA-cg48-9hh2-x6mx

    HTML Injection in preact

    Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-S…

    preact npm