CVE-2026-47099: TeleJSON DOM-Based XSS Vulnerability

CVE-2026-47099 Overview

CVE-2026-47099 is a DOM-based cross-site scripting (XSS) vulnerability in TeleJSON versions prior to 6.0.0. The library, maintained by the Storybook project, provides JSON serialization with support for reviving complex JavaScript types. The flaw resides in the parse() function, where a custom reviver passes a user-controlled _constructor-name_ property directly to new Function() without sanitization. Attackers can deliver a crafted JSON payload through vectors such as postMessage in cross-frame communication contexts to execute arbitrary JavaScript within the application. The vulnerability is classified under CWE-79.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of applications that pass attacker-influenced JSON to TeleJSON's parse() function.

Affected Products

TeleJSON versions prior to 6.0.0
Applications and frameworks bundling vulnerable TeleJSON releases
Storybook builds that rely on TeleJSON for cross-frame messaging

Discovery Timeline

2026-05-20 - CVE-2026-47099 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-47099

Vulnerability Analysis

TeleJSON serializes and deserializes JavaScript objects, preserving constructor metadata so consumers can reconstruct typed instances on the receiving end. During parsing, the library inspects each object for a _constructor-name_ property to identify the original prototype. The reviver then invokes new Function() with the constructor name as its argument to recreate the prototype binding. Because the constructor name originates from the JSON payload itself, an attacker who controls that field can supply JavaScript source code instead of a legitimate identifier. The dynamic function is invoked during parsing, resulting in script execution inside the parsing context.

Root Cause

The root cause is unsanitized input flowing into a JavaScript code-construction sink. The parse() reviver treats the _constructor-name_ value as trusted data and concatenates it into a new Function() invocation. JavaScript's Function constructor compiles its string argument as executable code, making it functionally equivalent to eval(). No allow-list, type check, or identifier validation is applied before this evaluation occurs.

Attack Vector

Exploitation requires the victim application to call TeleJSON's parse() on attacker-influenced data. A common path is browser postMessage handlers that forward inbound message data into TeleJSON without origin or schema validation. An attacker hosting a malicious page can frame the target, post a JSON object whose _constructor-name_ field contains executable JavaScript, and trigger script execution when the receiver parses the payload. User interaction with the attacker-controlled context is required, consistent with the CVSS UI:A metric. Refer to the GitHub Security Advisory and the VulnCheck Advisory: DOM-Based XSS for additional technical detail.

Detection Methods for CVE-2026-47099

Indicators of Compromise

JSON payloads received via postMessage, WebSocket, or HTTP responses containing the _constructor-name_ property with values longer than a typical identifier or containing whitespace, parentheses, or semicolons.
Browser console errors referencing anonymous functions created from new Function() during page load or message handling.
Unexpected outbound network requests originating from pages that consume TeleJSON-parsed data.

Detection Strategies

Inventory dependencies and flag any project resolving telejson to a version below 6.0.0 using npm ls telejson or software composition analysis tooling.
Add static analysis rules that match the literal string _constructor-name_ in inbound JSON or message handler logs.
Instrument browser telemetry to capture message event payloads and inspect them for the vulnerable property name.

Monitoring Recommendations

Forward Content Security Policy (CSP) violation reports to a centralized log store and alert on script-src violations tied to inline or unsafe-eval execution.
Monitor build pipelines for transitive installs of vulnerable TeleJSON releases and fail CI on detection.
Track Storybook and frontend framework advisories for downstream patch availability.

How to Mitigate CVE-2026-47099

Immediate Actions Required

Upgrade telejson to version 6.0.0 or later across all direct and transitive dependencies.
Audit postMessage and other cross-frame handlers to confirm strict origin validation before invoking parse().
Remove unsafe-eval from production Content Security Policy directives to constrain new Function() abuse.

Patch Information

The maintainers addressed the issue in TeleJSON 6.0.0 by removing the unsafe new Function() invocation in the reviver path. Consumers should bump the dependency in package.json and refresh lockfiles. Details are documented in the GitHub Security Advisory GHSA-ccgf-5rwj-j3hv.

Workarounds

Wrap calls to TeleJSON.parse() with a pre-parse filter that strips the _constructor-name_ property from untrusted payloads.
Restrict message event listeners to verified origins and reject payloads that do not match an expected schema.
Enforce a strict CSP that omits unsafe-eval to block the dynamic Function constructor sink.

bash

# Configuration example
npm install telejson@^6.0.0
npm ls telejson