CVE-2026-47099 describes a DOM-based XSS vulnerability in storybookjs's TeleJSON library before version 6.0.0. The parse() function's custom reviver passes the constructor name directly to new Function() without sanitization, enabling attackers to inject arbitrary JavaScript code. Attackers can exploit this by sending a crafted JSON payload containing a malicious _constructor-name_ property, which is then executed in the application context, for example through postMessage in cross-frame communication scenarios.

An attacker can execute arbitrary JavaScript code within the context of the vulnerable application by exploiting this XSS vulnerability. This could lead to unauthorized script execution affecting the confidentiality and integrity of the application environment. However, the CVSS score of 2.1 and the low severity rating indicate that exploitation requires user interaction and the impact is limited in scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, avoid parsing untrusted JSON payloads with TeleJSON's parse() function, especially in contexts involving cross-frame communication such as postMessage. Monitor vendor channels for updates and apply official fixes once available.