PT-2026-22027 · Storybook · Storybook

Aikido-Security + 3 · Published 2026-02-25 · Updated 2026-02-26 · CVE-2026-27148

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Storybook versions prior to 7.6.23 Storybook versions prior to 8.6.17 Storybook versions prior to 9.1.19 Storybook versions prior to 10.2.10

Description Storybook’s dev server WebSocket functionality, used for creating and updating stories, is susceptible to WebSocket hijacking. This issue impacts the dev server only and does not affect production builds. Exploitation requires a developer to visit a malicious website while running the local Storybook dev server. The WebSocket connection lacks origin validation, allowing a malicious site to send WebSocket messages to the local instance without user interaction. If the Storybook dev server is publicly exposed, an unauthenticated attacker can directly send WebSocket messages. The WebSocket message handlers for creating and saving stories are vulnerable to injection through unsanitized input in the componentFilePath field, potentially leading to persistent Cross-Site Scripting (XSS) or Remote Code Execution (RCE).

Recommendations Update Storybook to version 7.6.23 or later. Update Storybook to version 8.6.17 or later. Update Storybook to version 9.1.19 or later. Update Storybook to version 10.2.10 or later.

Exploit

Fix

RCE

XSS

Special Elements Injection

Weakness Enumeration

CWE-79

CWE-74

CWE-1385

Related Identifiers

CVE-2026-27148

GHSA-MJF5-7G4M-GX5W

Affected Products

Storybook

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27148.json · Exploit
• https://github.com/storybookjs/storybook/commit/b8cfa77c73940c140acdcd8a06ab1ea913c44761 · Patch
• https://github.com/storybookjs/storybook/security/advisories/GHSA-mjf5-7g4m-gx5w · Vendor Advisory
• https://github.com/storybookjs/storybook/commit/0affdf928bd6fafbadfb1dfe22ce6104805e10e8 · Patch
• https://github.com/storybookjs/storybook/commit/54689a8add18ea75d628c540f4bc677592a1e685 · Patch
• https://github.com/storybookjs/storybook/commit/d34085f39c647f5c23c3a3b2d197c18602fcf876 · Patch
• https://osv.dev/vulnerability/CVE-2026-27148 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mjf5-7g4m-gx5w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27148 · Security Note
• https://github.com/storybookjs/storybook · Note
• https://github.com/storybookjs/storybook/releases/tag/v9.1.19 · Note
• https://github.com/storybookjs/storybook/releases/tag/v10.2.10 · Note
• https://github.com/storybookjs/storybook/releases/tag/v7.6.23 · Note
• https://github.com/storybookjs/storybook/releases/tag/v8.6.17 · Note
• https://twitter.com/infoflowcloud/status/2027006387125879222 · Twitter Post