p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in storybook

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für storybook: 2. Davon im KEV-Katalog: 0.

RSS ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 4

  1. CVE-2026-114126

    Hoch · CVSS 8.7EPSS 0,48%Korrektur verfügbar

    Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload

    storybook storybook storybook storybookNode.js
    • Auf 10.6.2 aktualisieren
    • Auf 11.0.0-alpha.6 aktualisieren
    • Auf 8.6.19 aktualisieren
    • Auf 9.1.21 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-114125

    Hoch · CVSS 8.6EPSS 0,38%Korrektur verfügbar

    Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This iss

    storybook storybook storybook storybookNode.js
    • Auf 10.6.2 aktualisieren
    • Auf 11.0.0-alpha.6 aktualisieren
    • Auf 8.6.19 aktualisieren
    • Auf 9.1.21 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-27148

    Hoch · CVSS 8.9EPSS 0,7%Korrektur verfügbar

    Storybook Dev Server Vulnerable to WebSocket Hijacking

    Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev server; production builds are not impacted. Exploitation requires a developer to visit a malicious website while their local Storybook dev server is running. Because the WebSocket connection does not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to the local instance

    storybook storybook storybookNode.js
    • Auf 10.2.10 aktualisieren
    • Auf 8.6.17 aktualisieren
    • Auf 9.1.19 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2025-68429

    Hoch · CVSS 7.3EPSS 0,26%Korrektur verfügbar

    Storybook manager bundle may expose environment variables during build

    Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it mus

    storybook storybook storybook storybookNode.js
    • Auf 10.1.10 aktualisieren
    • Auf 7.6.21 aktualisieren
    • Auf 8.6.15 aktualisieren
    • Auf 9.1.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →