Описание
TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious constructor-name property value. The custom reviver passes the constructor name directly to new Function() without sanitization when recreating object prototypes, enabling attackers to inject arbitrary JavaScript through vectors such as postMessage in cross-frame communication contexts to achieve script execution within the application.
A flaw was found in TeleJSON. A remote attacker can exploit this DOM-based cross-site scripting (XSS) vulnerability by delivering a specially crafted JSON payload. This payload, containing a malicious _constructor-name_ property value, is processed by the parse() function without proper sanitization, allowing the attacker to execute arbitrary JavaScript code within the application. This could lead to unauthorized actions or information disclosure.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Node HealthCheck Operator | workload-availability/node-healthcheck-must-gather-rhel9 | Fix deferred | ||
| Node HealthCheck Operator | workload-availability/node-healthcheck-operator-bundle | Fix deferred | ||
| Node HealthCheck Operator | workload-availability/node-healthcheck-rhel9-operator | Fix deferred | ||
| Red Hat Fuse 7 | telejson | Fix deferred | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mlflow-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious _constructor-name_ property value. The custom reviver passes the constructor name directly to new Function() without sanitization when recreating object prototypes, enabling attackers to inject arbitrary JavaScript through vectors such as postMessage in cross-frame communication contexts to achieve script execution within the application.
TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`
EPSS
5.4 Medium
CVSS3