Summary
TeleJSON: DOM XSS via unsanitised constructor name in new Function()
telejson versions prior to 6.0.0 (released 2022) are vulnerable to DOM-based Cross-Site Scripting (XSS) through unsafe deserialisation. Attacker-controlled input from the _constructor-name_ property in parsed JSON is passed directly to new Function() without sanitisation, allowing arbitrary JavaScript execution.
Affected versions
| Package | Affected | Fixed |
|---|---|---|
| telejson | < 6.0.0 | >= 6.0.0 |
Details
telejson's parse() function uses a custom reviver to reconstruct JavaScript objects from serialised JSON. When processing objects with a _constructor-name_ property, the reviver passes the constructor name directly to new Function() to recreate the object's prototype.
In versions prior to 6.0.0, this constructor name is not sanitised. An attacker who can deliver a crafted JSON payload to telejson.parse() (for example, via postMessage in applications that use telejson for cross-frame communication) can inject arbitrary JavaScript into the new Function() call.
Vulnerable code (src/index.ts, lines 293-299 at v5.3.3):
if (isObject<ValueContainer>(value) && value['_constructor-name_']) {
const name = value['_constructor-name_'];
if (name !== 'Object') {
const Fn = new Function(`return function ${name}(){}`)();
Object.setPrototypeOf(value, new Fn());
}
Fixed code (src/index.ts, lines 340-346 at v6.0.0):
if (isObject<ValueContainer>(value) && value['_constructor-name_'] && options.allowFunction) {
const name = value['_constructor-name_'];
if (name !== 'Object') {
const Fn = new Function(`return function ${name.replace(/[\W_]+/g, '')}(){}`)();
Object.setPrototypeOf(value, new Fn());
}
The fix introduces two mitigations: a character allowlist via regex that strips non-word characters before they reach new Function(), and gating the entire code path behind the allowFunction option.
Impact
An attacker can execute arbitrary JavaScript in the context of the application using the vulnerable telejson version. Depending on the application, this could enable session hijacking, credential theft, or arbitrary DOM manipulation.
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
CVE-2026-47099 has a CVSS score of 6.1 (Low). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (6.0.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to telejson >= 6.0.0.
Frequently Asked Questions
- What is CVE-2026-47099? CVE-2026-47099 is a low-severity cross-site scripting (XSS) vulnerability in telejson (npm), affecting versions < 6.0.0. It is fixed in 6.0.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- How severe is CVE-2026-47099? CVE-2026-47099 has a CVSS score of 6.1 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of telejson are affected by CVE-2026-47099? telejson (npm) versions < 6.0.0 is affected.
- Is there a fix for CVE-2026-47099? Yes. CVE-2026-47099 is fixed in 6.0.0. Upgrade to this version or later.
- Is CVE-2026-47099 exploitable, and should I be worried? Whether CVE-2026-47099 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-47099 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-47099? Upgrade
telejsonto 6.0.0 or later.