Skip to content
Fencer Vulns
medium 6.1

CVE-2026-22028 json

Preact has JSON VNode Injection issue

published 2026-01-07 10 mo ago modified 2026-09-10 1 mo ago also GHSA-36hm-qxxp-pg3m , EUVD-2026-1184

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from arbitrary JSON. A regression introduced in Preact 10.26.5 caused this protection to be softened. In applications where values from JSON payloads are assumed to be strings and passed unmodified to Preact as children, a specially-crafted JSON payload could be constructed that would be incorrectly treated as a valid VNode. When this chain of failures occurs it can result in HTML injection, which can allow arbitrary script execution if not mitigated by CSP or other means. Applications using affected Preact versions are vulnerable if they meet all of the following conditions: first, pass unmodified, unsanitized values from user-modifiable data sources (APIs, databases, local storage, etc.) directly into the render tree; second assume these values are strings but the data source could return actual JavaScript objects instead of JSON strings; and third, the data source either fails to perform type sanitization AND blindly stores/returns raw objects interchangeably with strings, OR is compromised (e.g., poisoned local storage, filesystem, or database). Versions 10.26.10, 10.27.3, and 10.28.2 patch the issue. The patch versions restore the previous strict equality checks that prevent JSON-parsed objects from being treated as valid VNodes. Other mitigations are available for those who cannot immediately upgrade. Validate input types, cast or validate network data, sanitize external data, and use Content Security Policy (CSP).

Patch / fix

  • npm preact 10.26.10, 10.27.3, 10.28.2
  • preactjs preact 10.26.10, 10.27.3, 10.28.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-22028 updated cvss 6.1

preact: Preact: Arbitrary script execution via JSON serialization protection bypass

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/fluentd-rhel9, openshift-logging/logging-view-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9 Red Hat Enterprise Linux 9 polkit, firefox, firefox-x11, polkit-libs, thunderbird
    affected: workaround, no fix available
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-model-registry-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat streams for Apache Kafka 3 com.github.streamshub-console
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4.20 openshift4 1774977480
    fixed: vendor fix RHSA-2026:6564
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9, openshift-logging/eventrouter-rhel9, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/log-file-metric-exporter-rhel9, openshift-logging/cluster-logging-operator-bundle
    not affected: component not present
  • Red Hat Ansible Automation Platform 2 automation-platform-ui, ansible-automation-platform-26/gateway-rhel9
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 7 firefox Red Hat Enterprise Linux 8 firefox, mozjs60, thunderbird Red Hat Enterprise Linux 9 gjs Red Hat Enterprise Linux 10 gjs, firefox, thunderbird
    not affected: vulnerable code not in execute path
show 1 more
  • Red Hat OpenShift Container Platform 4.20 openshift4 1774566989, openshift4 1774567078, openshift4 1774567421, openshift4 1774568659, openshift4 1774569245, openshift4 1774573312, +180 more Red Hat streams for Apache Kafka 2 com.github.streamshub-console
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
10 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/preactjs/preact/security/advisories/GHSA-36hm-qxxp-pg3m referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 7.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CNA 4.0 7.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm preact
>=10.26.5, <10.26.10
>=10.27.0, <10.27.3
>=10.28.0, <10.28.2
10.26.10
10.27.3
10.28.2

Affected products

  • preactjs preact

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.