Storybook
CVE-2026-27148
HIGH
GHSA-mjf5-7g4m-gx5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure developer to malicious site
-
DeliveryBrowser opens WebSocket to localhost dev server
-
ExploitSend crafted create/save-story message
-
ExecutionInject unsanitized componentFilePath payload
-
PersistPersist stored XSS in story file
-
ImpactExecute code on developer host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Default attack requires three concrete conditions: (1) the Storybook DEV server is running (production/static builds are not affected), (2) the victim developer actively visits an attacker-controlled website in a browser with network access to the local instance (UI:A in the vector), and (3) the attacker sends a WebSocket message to the create-story or save-story handler carrying a malicious componentFilePath value, which is not origin-validated or sanitized. The limiting factors are the running-dev-server prerequisite and the required developer visit to a malicious site - there is no persistence or auth bypass needed because the endpoint performs no origin check. These conditions are removed in one configuration: if the dev server is intentionally exposed publicly (design reviews/stakeholder demos), no malicious-site visit is needed and any unauthenticated attacker can send the WebSocket messages directly, raising real risk. |
| Impact | Signals are mixed and must be weighed against deployment reality rather than the raw 8.9 CVSS 4.0 score. The vector (AV:N/AC:L/AT:P/PR:N/UI:A) shows network reach with no authentication but two real friction factors: a present Attack Requirement (AT:P) and Active user interaction (UI:A) - the developer must have the dev server running and must visit an attacker-controlled page. EPSS is low (0.17%, 38th percentile) and the issue is not in CISA KEV, with no public exploit identified, which is consistent with a developer-targeting rather than mass-internet-facing flaw. The most severe path - a publicly exposed dev server used for design reviews/demos - removes the user-interaction requirement and exposes high-impact RCE to unauthenticated attackers, but that is a non-default, opt-in deployment. Net: this is a real, high-impact issue for developer workstations and any intentionally exposed instance, but the low EPSS and required preconditions place it below internet-facing zero-day urgency. Note the conflict to verify: CVSS marks AV:N, yet default exploitation targets a localhost service via a malicious site - network reachability is browser-mediated, not direct, except in the publicly-exposed configuration. |
| Exploit ScenarioDerived | A developer runs |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 30, 2026
Cross-site WebSocket hijacking leading to persistent XSS and Remote Code Execution affects Storybook's dev server prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10. Because the dev server's story create/save WebSocket handlers fail to validate the connection origin and do not sanitize the componentFilePath field, a malicious website silently injects WebSocket messages into a developer's locally running instance to plant XSS or execute code; publicly exposed dev servers can be hit directly by any unauthenticated attacker. No public exploit identified at time of analysis, and EPSS is low at 0.17% (38th percentile), but the high CVSS 4.0 score of 8.9 and confirmed RCE impact make this a meaningful developer-workstation risk.
Earlier versions of this analysis (4)
Cross-Site WebSocket Hijacking in Storybook's dev server lets a malicious website silently send WebSocket messages to a developer's locally running instance, injecting unsanitized input through the componentFilePath field of the create/save-story handlers to achieve persistent XSS or remote code execution. Storybook versions before 7.6.23, 8.6.17, 9.1.19, and 10.2.10 are affected; only the dev server is impacted, not production builds. There is no public exploit identified at time of analysis, the EPSS probability is low (0.17%), and the issue is not in CISA KEV, but the dual XSS/RCE impact and trivial trigger (visiting a web page) make it a meaningful developer-workstation risk.
WebSocket hijacking in Storybook's development server allows persistent XSS and remote code execution against developers running affected versions prior to 7.6.23, 8.6.17, 9.1.19, and 10.2.10. The dev server's WebSocket endpoint for creating and saving stories fails to validate the origin of incoming connections, so a malicious website opened by a developer with a running Storybook instance can silently inject unsanitized input into the componentFilePath field. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%), but the high CVSS 4.0 score of 8.9 reflects the severe RCE impact on developer workstations; production builds are not affected.
WebSocket hijacking in Storybook's development server (versions prior to 7.6.23, 8.6.17, 9.1.19, and 10.2.10) lets a malicious website silently inject unsanitized input into the componentFilePath field of the create-story and save-story message handlers, achieving persistent XSS or remote code execution on a developer's machine. The dev server fails to validate the origin of incoming WebSocket connections, so any site a developer visits while Storybook is running can send commands without further interaction; publicly exposed dev servers can be hit directly by unauthenticated attackers. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%), but the high-fidelity RCE impact and trivial trigger make patching urgent.
Injection in Storybook UI component workshop.
RemediationAI
Vendor-released patch: upgrade to Storybook 7.6.23, 8.6.17, 9.1.19, or 10.2.10 (whichever matches your major line) per the GitHub release notes (https://github.com/storybookjs/storybook/releases/tag/v10.2.10 and the v7.6.23, v8.6.17, v9.1.19 tags) and advisory GHSA-mjf5-7g4m-gx5w; the fixes landed in commits 0affdf92, 54689a8a, b8cfa77c, and d34085f3. Until patched, do not expose the Storybook dev server beyond localhost - bind it to 127.0.0.1 and avoid public exposure for design reviews/demos (trade-off: remote stakeholders must use a static production build or an authenticated VPN/tunnel instead). Run the dev server only while actively developing and shut it down otherwise to shrink the window in which a malicious site can reach it, and avoid browsing untrusted sites in the same browser session while it runs (trade-off: workflow friction). Where remote sharing is required, publish a static storybook build artifact rather than the live dev server, which is not affected.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Storybook is a Node.js-based frontend workshop for developing UI components in isolation; during development it runs a local dev server that exposes a WebSocket channel used by the UI to create and update stories on disk. The root cause is CWE-74 (improper neutralization of special elements / injection): the WebSocket handlers for the create-story and save-story operations accept the componentFilePath value without sanitization, and the WebSocket endpoint performs no origin validation. The missing origin check is the classic Cross-Site WebSocket Hijacking (CSWSH) pattern - browsers do not enforce same-origin policy on WebSocket handshakes, so any web page the developer visits can open a socket to localhost. Combined with the unsanitized path/content being written into story files, the injected payload yields persistent stored XSS in the Storybook UI and, because story files are evaluated in the Node dev-server/build context, escalates to arbitrary code execution on the developer host. The affected component is the storybook package on the node.js platform (cpe:2.3:a:storybook:storybook), spanning the 7.x, 8.x, 9.x, and 10.x release lines.
Know when Storybook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Browser-mediated reach to a running localhost dev server plus required malicious-site visit gives AV:N/AC:H/UI:R/PR:N; story-write breaking out to host RCE is a scope change (S:C) with full C/I/A impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
8DescriptionCVE.org
Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev server; production builds are not impacted. Exploitation requires a developer to visit a malicious website while their local Storybook dev server is running. Because the WebSocket connection does not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to the local instance without any further user interaction. If the Storybook dev server is intentionally exposed publicly (e.g. for design reviews or stakeholder demos) the risk is higher, as no malicious site visit is required. Any unauthenticated attacker can send WebSocket messages to it directly. The vulnerability affects the WebSocket message handlers for creating and saving stories. Both are vulnerable to injection via unsanitized input in the componentFilePath field, which can be exploited to achieve persistent XSS or Remote Code Execution (RCE). Versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10 contain a fix for the issue.
Executive ViewAI
Storybook dev servers prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10 contain a WebSocket validation flaw that allows unauthenticated attackers to execute arbitrary code on developer workstations. This directly threatens source code integrity and creates a supply chain attack vector enabling malicious code injection into production releases.
Apply vendor patch. Interim mitigation: isolate all Storybook dev servers to localhost-only access and disable any publicly or externally exposed instances until upgrades are complete.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Storybook's `storybook dev` server hands its WebSocket authentication token to any client that can load its HTML pages,
Cross-origin message injection in the Storybook preview iframe lets a malicious website drive a developer's locally runn
Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from `.env`
Exploit-DB