TeleJSON < 6.0.0 DOM-based XSS via parse() Function
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious _constructor-name_ property value. The custom reviver passes the constructor name directly to new Function() without sanitization when recreating object prototypes, enabling attackers to inject arbitrary JavaScript through vectors such as postMessage in cross-frame communication contexts to achieve script execution within the application.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| storybookjs | telejson | before 6.0.0 | 6.0.0 | Patch available | CNA |
| — | telejson (npm) | before 6.0.0 | 6.0.0 | Patch available | GHSA-ccgf-5rwj-j3hv |
- telejson Vendorstorybookjs Affected before 6.0.0 Fixed in 6.0.0 Patch available CNA
- telejson (npm) Vendor— Affected before 6.0.0 Fixed in 6.0.0 Patch available GHSA-ccgf-5rwj-j3hv
Remediation
- Fix · CNA telejson (storybookjs) Fixed in 6.0.0
- Fix · GHSA-ccgf-5rwj-j3hv telejson (npm) Fixed in 6.0.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47099
- 2026-10-03 Alias added: GHSA-ccgf-5rwj-j3hv
References
More storybookjs vulnerabilities
- TI-2026-78906 Storybook dev server exposes WebSocket token to LAN attackers CVSS 4.0HIGH 8.7
- TI-2026-78905 Missing origin checks in Storybook preview allow code injection CVSS 4.0HIGH 8.6
Sources
- CVE-2026-47099 · CVE Program
- CVE-2026-47099 · NVD
- FIRST EPSS
- GHSA-ccgf-5rwj-j3hv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-47099 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences