CVE-2026-47099 storybookjs CVE debrief

Who should care

Teams that use TeleJSON in web applications, especially if parse() processes data from browsers, iframes, widgets, extensions, or any other untrusted JSON source. Front-end, platform, and application security teams should review any code paths that deserialize TeleJSON data on the client side.

Technical summary

According to the source description and NVD metadata, TeleJSON prior to 6.0.0 contains a DOM-based XSS vulnerability in parse(). A crafted JSON payload with a malicious _constructor-name_ property can influence the custom reviver logic, which passes the constructor name directly to new Function() when rebuilding prototypes. NVD lists the weakness as CWE-79. The published CVSS vector indicates network-reachable impact with required user interaction in a browser context, and the overall severity is low (CVSS 2.1), but the issue still enables script execution in affected application contexts.

Defensive priority

Low overall by CVSS, but worth prompt review in any browser-exposed TeleJSON usage because the flaw can lead to script execution when untrusted data is parsed.

Recommended defensive actions

• Upgrade TeleJSON to 6.0.0 or later, or move to a patched release if one is available in your dependency channel.
• Audit all uses of TeleJSON parse() and identify any paths that accept data from untrusted sources, especially postMessage, iframe, widget, and cross-origin integration flows.
• Treat any client-side deserialization of TeleJSON as untrusted input and add allowlisting or schema validation before prototype reconstruction.
• Search for custom wrappers or forks that replicate the same reviver logic and remove any use of new Function() on attacker-influenced values.
• If immediate upgrade is not possible, disable or isolate the affected parsing path until a fixed version can be deployed.
• Review browser-side hardening controls such as CSP and trusted data boundaries, but do not rely on them as the primary fix for this parsing flaw.

Evidence notes

CVE-2026-47099 was published and modified on 2026-05-20T20:16:41.063Z, and the supplied source item is the NVD modified feed entry with status 'Received'. The source corpus describes TeleJSON prior to 6.0.0 as vulnerable to DOM-based XSS in parse(), with a crafted _constructor-name_ value reaching new Function() without sanitization. NVD metadata attributes the weakness to CWE-79 and includes references to the GitHub security advisory and the Vulncheck advisory.

Official resources