Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the telejson library's parse function, which is responsible for deserializing JSON strings. The parse function utilizes a custom reviver function to handle the reconstruction of complex objects.
The root cause of the vulnerability lies within the reviver function. When it encounters an object with a _constructor-name_ property, it uses the value of this property to dynamically create a constructor function using new Function(). The value is used directly in the template string for new Function() without any prior sanitization.
An attacker can exploit this by crafting a JSON payload with a malicious _constructor-name_ that includes arbitrary JavaScript. When this payload is processed by telejson.parse(), the malicious code is executed within the context of the application. The fix for this vulnerability involves sanitizing the _constructor-name_ by removing any non-word characters before it is used in the new Function() call.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| telejson | npm | < 6.0.0 | 6.0.0 |
