Storybook
Monthly
Storybook's `storybook dev` server hands its WebSocket authentication token to any client that can load its HTML pages, so an unauthenticated attacker sharing the developer's local network can open the dev server's HTML, steal the token, and drive WebSocket-backed file-writing and testing APIs. Weak validation of story-file writes lets the attacker plant code inside story files, and when the Storybook Vitest addon is paired with an outdated Vitest the payload can pivot through the Vitest API to write arbitrary files or execute commands with the developer's privileges. Affected are releases from 8.0.0 up to (but excluding) 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6; the vector is AV:A/PR:N, so no credentials are needed but the attacker must be on the same adjacent network - no public exploit code identified at time of analysis.
Cross-origin message injection in the Storybook preview iframe lets a malicious website drive a developer's locally running `storybook dev` server, sending attacker-controlled events into the preview that can rewrite story files in the project and, if a modified file is later executed by a local runtime, achieve arbitrary code execution with the developer's privileges. The flaw affects Storybook 8.0.0 through 8.6.18, 9.0.0 through 9.1.20, 10.0.0 through 10.6.1, and 11.0.0-alpha.0 through alpha.5; per the CVSS vector it is unauthenticated (PR:N) but requires user interaction (UI:A), since the developer must visit the attacker's site and engage with the injected interface in the same browser. Storybook states it is not aware of exploitation in the wild, and no public exploit code has been identified at time of analysis.
Cross-site WebSocket hijacking leading to persistent XSS and Remote Code Execution affects Storybook's dev server prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10. Because the dev server's story create/save WebSocket handlers fail to validate the connection origin and do not sanitize the componentFilePath field, a malicious website silently injects WebSocket messages into a developer's locally running instance to plant XSS or execute code; publicly exposed dev servers can be hit directly by any unauthenticated attacker. No public exploit identified at time of analysis, and EPSS is low at 0.17% (38th percentile), but the high CVSS 4.0 score of 8.9 and confirmed RCE impact make this a meaningful developer-workstation risk.
Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from `.env` files when using `storybook build` command. Unpatched projects building Storybook in directories containing `.env` files risk bundling sensitive credentials into publicly viewable artifacts. Unauthenticated attackers accessing published Storybook bundles can extract secrets from source code. Runtime dev mode, CI builds using platform environment variables, and co-located applications remain unaffected. No public exploit identified at time of analysis.
Storybook's `storybook dev` server hands its WebSocket authentication token to any client that can load its HTML pages, so an unauthenticated attacker sharing the developer's local network can open the dev server's HTML, steal the token, and drive WebSocket-backed file-writing and testing APIs. Weak validation of story-file writes lets the attacker plant code inside story files, and when the Storybook Vitest addon is paired with an outdated Vitest the payload can pivot through the Vitest API to write arbitrary files or execute commands with the developer's privileges. Affected are releases from 8.0.0 up to (but excluding) 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6; the vector is AV:A/PR:N, so no credentials are needed but the attacker must be on the same adjacent network - no public exploit code identified at time of analysis.
Cross-origin message injection in the Storybook preview iframe lets a malicious website drive a developer's locally running `storybook dev` server, sending attacker-controlled events into the preview that can rewrite story files in the project and, if a modified file is later executed by a local runtime, achieve arbitrary code execution with the developer's privileges. The flaw affects Storybook 8.0.0 through 8.6.18, 9.0.0 through 9.1.20, 10.0.0 through 10.6.1, and 11.0.0-alpha.0 through alpha.5; per the CVSS vector it is unauthenticated (PR:N) but requires user interaction (UI:A), since the developer must visit the attacker's site and engage with the injected interface in the same browser. Storybook states it is not aware of exploitation in the wild, and no public exploit code has been identified at time of analysis.
Cross-site WebSocket hijacking leading to persistent XSS and Remote Code Execution affects Storybook's dev server prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10. Because the dev server's story create/save WebSocket handlers fail to validate the connection origin and do not sanitize the componentFilePath field, a malicious website silently injects WebSocket messages into a developer's locally running instance to plant XSS or execute code; publicly exposed dev servers can be hit directly by any unauthenticated attacker. No public exploit identified at time of analysis, and EPSS is low at 0.17% (38th percentile), but the high CVSS 4.0 score of 8.9 and confirmed RCE impact make this a meaningful developer-workstation risk.
Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from `.env` files when using `storybook build` command. Unpatched projects building Storybook in directories containing `.env` files risk bundling sensitive credentials into publicly viewable artifacts. Unauthenticated attackers accessing published Storybook bundles can extract secrets from source code. Runtime dev mode, CI builds using platform environment variables, and co-located applications remain unaffected. No public exploit identified at time of analysis.