p PatchFirst

PatchFirst · Latest vulnerabilities

@storybook/core-server vulnerabilities

Vulnerabilities published for @storybook/core-server in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-114126

    High · CVSS 8.7EPSS 0.48%Fix available

    Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload

    @storybook/core-serverNode.js
    • Update to 8.6.19
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-114125

    High · CVSS 8.6EPSS 0.38%Fix available

    Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This iss

    @storybook/core-serverNode.js
    • Update to 8.6.19
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →