{
  "id": "security/javascript/preactjs__preact-render-to-string/2026-10-06-nonstring-attr-encode-bypass",
  "title": "preact-render-to-string: non-string attribute values skip HTML entity encoding (SSR XSS)",
  "category": "security",
  "type": "xss",
  "severity": "low",
  "ecosystem": "javascript",
  "project": {
    "owner": "preactjs",
    "repo": "preact-render-to-string",
    "url": "https://github.com/preactjs/preact-render-to-string"
  },
  "affected_versions": [
    "preact-render-to-string <= 6.8.0"
  ],
  "status": "published",
  "summary": "In the default renderToString and renderToStaticMarkup path, only string attribute values were HTML-entity encoded. Arrays and objects with a custom toString were converted to text and written into the attribute without encoding, so quote characters in them could break out of the attribute and inject markup during server-side rendering. This is distinct from the Preact core issue GHSA-36hm-qxxp-pg3m. Fixed in 6.8.1.",
  "discovered_at": "2026-10-06T00:00:00+03:00",
  "updated_at": "2026-10-23T11:50:00+03:00",
  "public": true,
  "credit": "ucsurf",
  "disclosure": {
    "url": "https://github.com/preactjs/preact-render-to-string/security/advisories/GHSA-6jrx-cvj9-5x2x",
    "reported_at": "2026-10-08T16:15:02+03:00",
    "ghsa_id": "GHSA-6jrx-cvj9-5x2x",
    "channel": "pvr",
    "cve_id": null,
    "accepted_at": "2026-10-08T17:13:00+03:00",
    "published_at": "2026-10-23T11:39:27+03:00"
  },
  "patched_versions": [
    "preact-render-to-string 6.8.1"
  ],
  "cvss": null
}