CVE-2026-22028

A flaw was found in Preact, a lightweight web development framework. A security regression allows an attacker to bypass JSON serialization protection, leading to HTML injection. This vulnerability arises when applications process unsanitized data from external sources, allowing malicious JSON to be interpreted as valid user interface elements. If exploited, this could enable arbitrary script execution, potentially compromising user data or system integrity.

This vulnerability is rated Moderate for Red Hat because it requires applications to process unsanitized, user-modifiable JSON data directly into the render tree, assuming it to be strings. This specific configuration is not common in Red Hat products by default. Red Hat AMQ, Red Hat Ansible Automation Platform, OpenShift Lightspeed, OpenShift Container Platform, Red Hat Enterprise Linux, Red Hat In-Vehicle OS, Red Hat OpenShift AI (RHOAI), Ansible Services, Hosted OpenShift, and cloud.redhat.com are affected if they meet the described conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.