TeleJSON Vulnerability Enables Arbitrary JavaScript Execution Through Unsafe JSON Deserialization

TeleJSON's improper validation of the _constructor-name_ property creates a critical attack vector for front-end applications and Storybook instances. Attackers can inject malicious JavaScript code through crafted JSON payloads delivered via cross-frame messaging, potentially compromising user data and application integrity. Immediate upgrade to version 6.0.0 combined with strict origin validation for postMessage listeners is essential to mitigate this risk.