CVE-2026-22028
Critical · 9.8Preact has JSON VNode Injection issue
CVSS
9.8
EPSS
0.3%
Published
Jan 7, 2026
CISA due date
—
The record
**Vulnerability Type:** HTML Injection via JSON Type Confusion **Affected Versions:** Preact 10.26.5 through 10.28.1 **Severity:** Low to Medium (see below)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | preact | 10.26.5 | 10.26.10 |
| npm | preact | 10.27.0 | 10.27.3 |
| npm | preact | 10.28.0 | 10.28.2 |
| Chainguard | langfuse-3 | 0 | 3.146.0-r0 |
| Chainguard | langfuse-3-worker | 0 | 3.146.0-r0 |
| Chainguard | langfuse-fips-3 | 0 | 3.146.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.146.0-r0 |
| Wolfi | langfuse-3 | 0 | 3.146.0-r0 |
| Wolfi | langfuse-3-worker | 0 | 3.146.0-r0 |
Related vulnerabilities
- GHSA-36hm-qxxp-pg3m Preact has JSON VNode Injection issue Same vulnerability
- CVE-2026-33468 Kysely is a type-safe TypeScript SQL query builder. Also affects langfuse-3
- CVE-2026-33349 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries… Also affects langfuse-3
- CVE-2026-32887 Effect is a TypeScript framework that consists of several packages that work together to… Also affects langfuse-3
- GHSA-8cpq-38p9-67gx Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)`… Also affects langfuse-3
- GHSA-38f7-945m-qr2g Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under… Also affects langfuse-3
- CVE-2026-32763 Kysely is a type-safe TypeScript SQL query builder. Also affects langfuse-3
- GHSA-jp2q-39xq-3w4g Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in… Also affects langfuse-3