Executive brief
Preact is a lightweight JavaScript library used to build interactive web user interfaces. A regression in versions 10.26.5 through 10.28.1 allows attackers to inject arbitrary HTML and execute scripts if an application passes unsanitized data from external sources (APIs, databases, storage) directly to Preact without type validation. Exploitation requires weakly-designed APIs that don't enforce strict type checking or a compromised data source, but successful exploitation can lead to account takeover, data theft, or malware injection.
Technical details
Preact includes JSON serialization protection to prevent Virtual DOM (VNode) elements from being constructed from arbitrary JSON payloads. A regression introduced in Preact 10.26.5 softened this protection by relaxing strict equality checks. In applications where values from JSON payloads are assumed to be strings and passed directly to Preact as children without validation, a specially-crafted JSON object could be incorrectly treated as a valid VNode instead of being treated as a string value. This type confusion vulnerability enables HTML injection, which can result in arbitrary script execution unless mitigated by Content Security Policy (CSP) or similar defenses. Exploitation requires either insecure application design (no API-level type validation or sanitization) or a compromised data source. Patches restoring strict equality checks are available in versions 10.26.10, 10.27.3, and 10.28.2.
Affected products
- preactjs preact 10.26.5 to 10.26.9, 10.27.0 to 10.27.2, 10.28.0 to 10.28.1
Timeline
- 2026-01-07: disclosed: Vulnerability disclosed publicly
- 2026-01-06: patched: Patches released: 10.26.10, 10.27.3, 10.28.2