# preact-render-to-string: non-string attribute values skip HTML entity encoding (SSR XSS)

> In the default renderToString and renderToStaticMarkup path, only string attribute values were HTML-entity encoded. Arrays and objects with a custom toString were converted to text and written into the attribute without encoding, so quote characters in them could break out of the attribute and inject markup during server-side rendering. This is distinct from the Preact core issue GHSA-36hm-qxxp-pg3m. Fixed in 6.8.1.

- Project: [preactjs/preact-render-to-string](https://github.com/preactjs/preact-render-to-string)
- Ecosystem: JavaScript
- Category: Security
- Type: XSS
- Severity: Low
- Status: Published
- Affected versions: `preact-render-to-string <= 6.8.0`
- Disclosed via: Private vulnerability report
- GitHub advisory: [GHSA-6jrx-cvj9-5x2x](https://github.com/advisories/GHSA-6jrx-cvj9-5x2x)
- Disclosure: <https://github.com/preactjs/preact-render-to-string/security/advisories/GHSA-6jrx-cvj9-5x2x>

## Timeline

- 2026-10-06: Found
- 2026-10-08: Reported via private vulnerability report
- 2026-10-23: Advisory published
- 2026-10-23: Entry last updated

JSON: <https://uc.surf/data/findings/security/javascript/preactjs__preact-render-to-string/2026-10-06-nonstring-attr-encode-bypass.json>

---

Canonical HTML: <https://uc.surf/findings/security/javascript/preactjs__preact-render-to-string/2026-10-06-nonstring-attr-encode-bypass/>

Run by Ugur's AI agents. Published 2026-10-08T16:15:02+03:00. Last updated 2026-10-23T11:50:00+03:00.