CVE-2026-22028: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22028 is a JSON VNode Injection vulnerability in Preact, a lightweight JavaScript UI framework, caused by a regression that weakened JSON serialization protection introduced in version 10.26.5. The flaw allows specially-crafted JSON payloads to be incorrectly treated as valid Virtual DOM nodes (VNodes), potentially enabling HTML injection and arbitrary script execution. Affected versions span 10.26.5–10.26.9, 10.27.0–10.27.2, and 10.28.0–10.28.1. The vulnerability was reported on January 4, 2026, and publicly disclosed on January 7, 2026, with patches released on January 6, 2026. It carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 7.2 (High) (Github Advisory, Preact Advisory).

The root cause is a type confusion flaw (CWE-843: Access of Resource Using Incompatible Type) introduced as a regression in Preact 10.26.5, which softened strict equality checks that previously prevented JSON-parsed objects from being treated as valid VNodes. When an application passes unsanitized values from user-controllable data sources (APIs, databases, local storage) directly into the Preact render tree while assuming those values are strings, a crafted JSON payload containing a JavaScript object can be misinterpreted as a VNode. This chain of failures results in HTML injection, which can escalate to arbitrary script execution if no Content Security Policy (CSP) is in place. Exploitation requires either insecure API design (no type validation at boundaries) or a compromised data source; the regression was not present in preact-render-to-string. A network-based proof-of-concept was provided by the reporter (YoungGeun Choi / Xvezda) demonstrating real-world exploitability (Preact Advisory, Github Advisory).

Successful exploitation can result in HTML injection leading to arbitrary JavaScript execution in the context of a victim user's browser session, impacting both confidentiality (e.g., session token theft, data exfiltration) and integrity (e.g., DOM manipulation, phishing content injection). The vulnerability's scope is changed, meaning injected scripts can affect resources beyond the vulnerable component itself. Availability is not directly impacted, but the ability to execute arbitrary scripts enables a wide range of client-side attacks including credential harvesting and account takeover (Github Advisory, Red Hat Bugzilla).

A proof-of-concept demonstrating network-based exploitation was provided by the reporter on January 6, 2026, and is referenced in the GitHub Security Advisory. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been made. The EPSS score is approximately 0.057% (0.07% per Feedly), placing it in the 18th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific application conditions — unsanitized data passed directly to the render tree — limiting the practical attack surface (Github Advisory, Preact Advisory).

1. Identify a vulnerable target: Find a web application using Preact versions 10.26.5–10.28.1 that renders data from user-controllable sources (APIs, databases, local storage) without type validation.
2. Identify an injection point: Locate an API endpoint or data source whose responses are passed directly into the Preact render tree as children, where the application assumes the values are strings.
3. Craft a malicious JSON payload: Construct a JSON object that mimics the structure of a Preact VNode (e.g., containing type, props, and key fields) rather than a plain string value. For example: {"type": "script", "props": {"dangerouslySetInnerHTML": {"__html": "malicious_code"}}, "key": null}.
4. Inject the payload: Submit the crafted object to the data source (e.g., via a poisoned API response, compromised database entry, or manipulated local storage) so it is returned as a value where a string is expected.
5. Trigger rendering: Cause the victim user's browser to load the page or component that fetches and renders the malicious data through Preact.
6. Achieve script execution: Preact's weakened VNode validation incorrectly treats the crafted object as a valid VNode, rendering it as HTML and executing the injected script in the victim's browser context, enabling session theft, credential harvesting, or further attacks (Preact Advisory, Github Advisory).

• Network: Unexpected or malformed JSON responses from APIs containing object-type values where strings are expected; responses with VNode-like structures (type, props, key fields) in data fields.
• Logs: Server-side API logs showing unusual object payloads being stored or returned in fields expected to contain strings; client-side error logs referencing unexpected VNode rendering.
• Browser/Client: Unexpected script execution or DOM modifications in pages using Preact; browser console errors related to unexpected element types being rendered.
• Storage: Local storage or database entries containing JavaScript object structures (e.g., JSON with type and props keys) in fields that should hold plain string values.

Upgrade Preact to one of the patched versions: 10.26.10 (for 10.26.x users), 10.27.3 (for 10.27.x users), or 10.28.2 (for 10.28.x users), which restore strict equality checks preventing JSON-parsed objects from being treated as valid VNodes. This can be done via npm update preact. For applications unable to upgrade immediately: (1) validate input types and enforce strict type contracts at API boundaries; (2) cast or validate all network-sourced data before passing to Preact; (3) sanitize external data from APIs, databases, and storage before rendering; and (4) implement a strict Content Security Policy (CSP) to restrict inline script execution as a defense-in-depth measure (Preact Advisory, Github Advisory).

The vulnerability was responsibly disclosed by security researcher YoungGeun Choi (Xvezda), who provided detailed reproduction steps and a network-based proof-of-concept. The Preact maintainer JoviDeCroock published the advisory and released hotfix patches within two days of the initial report. Red Hat tracked the issue via Bugzilla (Bug 2427941) and assessed it as medium severity. Social media activity was limited, with a Bluesky post noted shortly after disclosure. The advisory characterizes this as primarily an "expanded attack surface" issue rather than a standalone vulnerability, noting that exploitation requires specific insecure application patterns (Preact Advisory, Red Hat Bugzilla).