JavaScriptSeverity: LowStatus: Published

preact-render-to-string: non-string attribute values skip HTML entity encoding (SSR XSS)

In the default renderToString and renderToStaticMarkup path, only string attribute values were HTML-entity encoded. Arrays and objects with a custom toString were converted to text and written into the attribute without encoding, so quote characters in them could break out of the attribute and inject markup during server-side rendering. This is distinct from the Preact core issue GHSA-36hm-qxxp-pg3m. Fixed in 6.8.1.

Timeline

6 October 2026 Found
8 October 2026 Reported via private vulnerability report
23 October 2026 Advisory published
23 October 2026 Entry last updated

Machine-readable: JSON · Markdown · ID security/javascript/preactjs__preact-render-to-string/2026-10-06-nonstring-attr-encode-bypass