CVE-2026-47099

Vulnerability

TeleJSON prior to version 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function. When reconstructing JavaScript objects from serialized JSON, the custom reviver passes the value of the _constructor-name_ property directly to new Function() without sanitization, enabling injection of arbitrary JavaScript code [1][2][3][4].

Exploitation

An attacker can deliver a crafted JSON payload containing a malicious _constructor-name_ value to the telejson.parse() function. This can be achieved, for example, via postMessage in cross-frame communication contexts. The attacker does not need authentication; user interaction may be required depending on the delivery vector. The payload is passed to new Function() which executes the injected code [2][3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the application using the vulnerable TeleJSON version. This could lead to session hijacking, credential theft, or other malicious actions depending on the application's permissions and data accessibility [2][3].

Mitigation

The vulnerability is fixed in TeleJSON version 6.0.0, released in 2022 [1][2][3]. The fix introduces sanitization of the constructor name using a regular expression to strip non-word characters, and gates the vulnerable code path behind an allowFunction option. Users should upgrade to version 6.0.0 or later. No workarounds are provided for earlier versions [2][3].