CVE-2026-47099 json
TeleJSON < 6.0.0 DOM-based XSS via parse() Function
published 7mo ago modified 3d ago also EUVD-2026-31150 , GHSA-ccgf-5rwj-j3hv
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious _constructor-name_ property value. The custom reviver passes the constructor name directly to new Function() without sanitization when recreating object prototypes, enabling attackers to inject arbitrary JavaScript through vectors such as postMessage in cross-frame communication contexts to achieve script execution within the application.
Patch / fix
- npm telejson 6.0.0
- storybookjs telejson 6.0.0
Is CVE-2026-47099 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-47099 updated cvss 5.4
telejson: TeleJSON: Arbitrary code execution via DOM-based cross-site scripting
-
Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat Fuse 7 telejson Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9affected: workaround, no fix available “Fix deferred”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | telejson | <6.0.0 |
6.0.0 |
Affected products
- storybookjs telejson
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/storybookjs/telejson/security/advisories/GHSA-ccgf-5rwj-j3hv
vendor-advisory, web, advisory
-
github.com
/Niccolo10/Security-Advisories/blob/main/CVE-2026-47099/cve-2026-47099.md
technical-description, web
-
vulncheck.com
/advisories/telejson-dom-based-xss-via-parse-function
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-47099
advisory
-
github.com
/storybookjs/telejson
package
Sources
- CVE List CVE-2026-47099
- GitHub Advisory GHSA-ccgf-5rwj-j3hv
- NVD CVE-2026-47099
- Maintainer advisory GHSA-ccgf-5rwj-j3hv
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of storybookjs/telejson published their own advisory on GitHub. Reviewed sources take precedence over it.