TeleJSON prior to version 6.0.0 contains a DOM-based cross‑site scripting vulnerability in the parse() function. An attacker can craft a JSON payload that includes a malicious _constructor-name_ property value. The library’s custom reviver passes this value directly to new Function without sanitization when recreating object prototypes, allowing the attacker to inject and execute arbitrary JavaScript inside the application. This can lead to script execution that may compromise confidentiality, integrity, or availability of the application’s data.

The affected product is TeleJSON by storybookjs for all releases prior to 6.0.0. No specific sub‑versions are listed; any installation using a version older than 6.0.0 is potentially vulnerable.

The CVSS score of 2.1 indicates a low severity. The EPSS score is not available, so the exploitation probability is unclear but likely low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to involve delivery of a crafted JSON payload via mechanisms such as postMessage in cross‑frame communication, where the victim application parses the payload with the vulnerable parse() function. Successful exploitation requires the attacker to provide the malicious data to the victim and for the application to invoke parse() with a custom reviver that would evaluate the new Function.