Preact implements JSON serialization protection to guard against virtual‑dom elements constructed from arbitrary JSON. A regression introduced in version 10.26.5 relaxed that protection, allowing a specially crafted JSON payload to be interpreted as a valid VNode. If an application renders unsanitized values from user‑modifiable sources directly as children, the flaw can inject HTML that is then interpreted by the browser, enabling arbitrary script execution. The vulnerability is a type‑confusion flaw (CWE‑843) and results in a classic XSS vector.

The Preact library, developed by preactjs, is affected. Versions beginning with 10.26.5 up to but not including 10.28.2 are vulnerable. The fix is applied in 10.26.10, 10.27.3, and 10.28.2. Any application using Preact within that range and feeding unvalidated JSON payloads into the render tree is at risk.

The CVSS score of 7.2 indicates high severity. The EPSS score is below 1 %, implying a low current exploitation probability. The vulnerability is not listed in CISA's KEV catalogue. Exploitation requires an attacker to supply or influence user‑modifiable data (e.g., via APIs, databases, or local storage) that contains objects instead of plain strings and is directly rendered by Preact. If all conditions are met, an attacker can inject arbitrary HTML and scripts, compromising confidentiality, integrity, and availability of the affected application.