Dashboard / CVE-2026-47099

CVE-2026-47099

LOW
INFO Priority: 0.01 BB Relevance: 54/100
Published: 2026-05-20 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Active
AT: Present
VC: None
VI: None
VA: None

Description

TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious _constructor-name_ property value. The custom reviver passes the constructor name directly to new Function() without sanitization when recreating object prototypes, enabling attackers to inject arbitrary JavaScript through vectors such as postMessage in cross-frame communication contexts to achieve script execution within the application.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
storybookjs telejson 0 < 6.0.0

References & Advisories (3)

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

2.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.36%
Raw Score 0.003580
Percentile 30.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00358
2026-11-12
0.00358
2026-11-10
0.00358
2026-11-09
0.00358
2026-11-08
0.00358

Intelligence Sources

mitre ref →

External Links