CVE-2026-27148: Storybook Dev Server WebSocket Hijacking Leading to Injection
Storybook's dev server accepts WebSocket connections without validating their origin, which allows a malicious site or an exposed server to send messages to the story create and save handlers. The record links unsanitized componentFilePath input to persistent XSS or remote code execution, and fixed releases are listed. No confirmed exploitation is reported in the sources consulted, and the CVE is not in CISA KEV.
Overview
Storybook is a frontend workshop tool used to build UI components and pages in isolation. According to the GitHub security advisory, the WebSocket functionality of the Storybook dev server, used to create and update stories, does not validate the origin of incoming connections.
Impact
The advisory describes two effects. A malicious website visited by a developer while the dev server runs can send WebSocket messages to the local instance. If the dev server is intentionally exposed on a network, unauthenticated parties can send such messages directly.
- The affected handlers are the ones that create and save stories.
- Unsanitized input in the componentFilePath field is described as enabling persistent XSS or remote code execution (RCE).
- Production builds are stated not to be affected.
The NVD base score is 9.6 and the GitHub score is 8.9, as recorded in the NVD entry. The weakness is classified as CWE-74 (Injection).
Affected products and versions
The record lists these ranges:
- Before 7.6.23.
- From 8.1.0 up to and including 8.6.17.
- From 9.0.0 up to and including 9.1.19.
- From 10.0.0 up to and including 10.2.10.
The fixed releases are 7.6.23, 8.6.17, 9.1.19 and 10.2.10. Versions outside these ranges, such as those before 8.1.0 in the 8 line, are not listed as affected, but the record does not explicitly confirm the status of every older release.
Exploitation status
CISA KEV does not list this CVE. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The EPSS probability recorded is 0.00701, with a percentile of 0.52706. The SSVC fields in the record indicate exploitation none and automatable no.
Remediation and mitigation
- Upgrade Storybook to the fixed release in the same major line: 7.6.23, 8.6.17, 9.1.19 or 10.2.10.
- Stop exposing the dev server to untrusted networks, including for design reviews or demos, until the upgrade is complete.
- Avoid browsing untrusted websites on the same machine while a Storybook dev server is running.
- Review the CVE record and the Red Hat CVE page for vendor tracking updates.
Detection guidance
- Inventory projects and dependency lock files to find Storybook versions in the affected ranges.
- Check whether any dev server instances are reachable from networks beyond the developer workstation.
- Review dev server logs, if enabled, for WebSocket connections from unexpected origins or unfamiliar clients. Log availability is not confirmed by the record.
Limitations of the available information
The record does not describe a specific proof of concept, detection signature or vendor-published indicator of compromise. It does not state whether every route to remote code execution has been demonstrated. Whether older unsupported releases outside the listed ranges are affected is not clearly stated. The EPSS date in the record is unusual and was not independently verified.
Frequently asked questions
Are production Storybook builds affected by CVE-2026-27148?
The record states that this vulnerability only affects the Storybook dev server and that production builds are not impacted.
Which versions contain the fix?
Versions 7.6.23, 8.6.17, 9.1.19 and 10.2.10 contain the fix. The record lists affected ranges before 7.6.23, from 8.1.0 up to and including 8.6.17, from 9.0.0 up to and including 9.1.19, and from 10.0.0 up to and including 10.2.10.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.