CVE-2026-27148

CVE-2026-27148 affects Storybook’s dev server frontend tooling. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket handlers used to create/save stories do not validate origin, allowing WebSocket hijacking. An unauthenticated attacker can send messages to the local dev server, an...

CVE-2026-27148: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability...