Executive brief
Preact is a lightweight JavaScript UI library that developers use to build interactive web interfaces. Versions 10.0.0-alpha and beta prior to 10.0.0-beta.1 can be exploited to execute malicious JavaScript if an application passes unsanitized JSON-parsed data directly into page rendering. This could allow attackers to steal user credentials, deface web pages, or hijack user sessions.
Technical details
The vulnerability is an HTML/script injection flaw (CWE-74) in preact's virtual DOM rendering. When untrusted JSON-parsed input is passed directly into JSX without validation, an attacker can inject malicious JavaScript objects that are rendered as virtual nodes, leading to cross-site scripting (XSS). The attack requires the application to explicitly deserialize user input with JSON.parse() and pass it to JSX rendering. The fix was released in preact 10.0.0-beta.1 via pull request #1528, which adds input validation to prevent JSON object injection.
Affected products
- Preact Preact 10.0.0-alpha.0 to 10.0.0-beta.0
Timeline
- 2020-09-02: disclosed
- 2020-04-20: patched: Fix merged to master branch