CVE-2026-22028
HTML Injection via JSON Deserialization Flaw in Preact VNode Rendering
Publication date: 2026-01-08
Last updated on: 2026-01-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| preact | preact | From 10.26.5 (inc) to 10.28.1 (inc) |
| preact | preact | 10.26.10 |
| preact | preact | 10.27.3 |
| preact | preact | 10.28.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-843 | The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Preact versions 10.26.5 through 10.28.1 is caused by a regression that weakened JSON serialization protections. It allows specially crafted JSON payloads containing JavaScript objects, instead of expected strings, to be incorrectly interpreted as valid Virtual DOM nodes (VNodes). This happens when applications pass unmodified, unsanitized user-controllable data directly into the render tree, assuming the data are strings. The result can be HTML injection, potentially leading to arbitrary script execution if not mitigated by Content Security Policy (CSP) or other defenses. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to HTML injection and arbitrary script execution within affected applications. This can compromise the security of the application and its users by allowing attackers to run malicious scripts, potentially leading to data theft, session hijacking, or other malicious activities. The vulnerability requires insecure API design or compromised data sources to be exploitable. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying if your application uses affected Preact versions (10.26.5 through 10.28.1) and whether it passes unmodified, unsanitized user-controllable data assumed to be strings directly into the render tree. You can check your installed Preact version using npm commands such as 'npm list preact' or 'npm ls preact'. Additionally, audit your application code for places where JSON payloads are parsed and passed to Preact without type validation or sanitization. There are no specific network commands provided for detection, but reviewing logs or monitoring for unusual HTML injection or script execution behavior may help identify exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Preact to patched versions 10.26.10, 10.27.3, or 10.28.2 which restore strict equality checks preventing JSON-parsed objects from being treated as valid VNodes. If upgrading is not immediately possible, implement strict input validation to reject arbitrary objects, enforce strict type contracts at API boundaries, cast or validate network data before rendering, sanitize all external data sources, and apply a strict Content Security Policy (CSP) to prevent inline script execution. [1]