PT-2026-22027 · Storybook · Storybook
Aikido-Security
+3
·
Publicado
2026-02-25
·
Atualizado
2026-02-26
·
CVE-2026-27148
CVSS v3.1
9.6
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Storybook versions prior to 7.6.23
Storybook versions prior to 8.6.17
Storybook versions prior to 9.1.19
Storybook versions prior to 10.2.10
Description
Storybook’s dev server WebSocket functionality, used for creating and updating stories, is susceptible to WebSocket hijacking. This issue impacts the dev server only and does not affect production builds. Exploitation requires a developer to visit a malicious website while running the local Storybook dev server. The WebSocket connection lacks origin validation, allowing a malicious site to send WebSocket messages to the local instance without user interaction. If the Storybook dev server is publicly exposed, an unauthenticated attacker can directly send WebSocket messages. The WebSocket message handlers for creating and saving stories are vulnerable to injection through unsanitized input in the
componentFilePath field, potentially leading to persistent Cross-Site Scripting (XSS) or Remote Code Execution (RCE).Recommendations
Update Storybook to version 7.6.23 or later.
Update Storybook to version 8.6.17 or later.
Update Storybook to version 9.1.19 or later.
Update Storybook to version 10.2.10 or later.
Exploit
Correção
RCE
XSS
Special Elements Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Storybook