CVE-2026-47099 json
TeleJSON < 6.0.0 DOM-based XSS via parse() Function
published 2026-04-02 7 mo ago modified 2026-11-08 23 h ago also EUVD-2026-31150 , GHSA-ccgf-5rwj-j3hv
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious _constructor-name_ property value. The custom reviver passes the constructor name directly to new Function() without sanitization when recreating object prototypes, enabling attackers to inject arbitrary JavaScript through vectors such as postMessage in cross-frame communication contexts to achieve script execution within the application.
Patch / fix
- npm telejson 6.0.0
- storybookjs telejson 6.0.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-47099 updated cvss 5.4
telejson: TeleJSON: Arbitrary code execution via DOM-based cross-site scripting
-
Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat Fuse 7 telejson Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9affected: workaround, no fix available “Fix deferred”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | telejson | <6.0.0 |
6.0.0 |
Affected products
- storybookjs telejson
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/storybookjs/telejson/security/advisories/GHSA-ccgf-5rwj-j3hv
vendor-advisory, web
-
github.com
/Niccolo10/Security-Advisories/blob/main/CVE-2026-47099/cve-2026-47099.md
technical-description, web
-
vulncheck.com
/advisories/telejson-dom-based-xss-via-parse-function
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-47099
advisory
-
github.com
/storybookjs/telejson
package
Sources
- CVE List CVE-2026-47099
- GitHub Advisory GHSA-ccgf-5rwj-j3hv
- NVD CVE-2026-47099
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.