PT-2026-22027 · Storybook · Storybook
CVSS v4.0
8.9
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
Storybook versions prior to 7.6.23
Storybook versions prior to 8.6.17
Storybook versions prior to 9.1.19
Storybook versions prior to 10.2.10
Description
Storybook’s dev server WebSocket functionality, used for creating and updating stories, is susceptible to WebSocket hijacking. This issue impacts the dev server only and does not affect production builds. Exploitation requires a developer to visit a malicious website while running the local Storybook dev server. The WebSocket connection lacks origin validation, allowing a malicious site to send WebSocket messages to the local instance without user interaction. If the Storybook dev server is publicly exposed, an unauthenticated attacker can directly send WebSocket messages. The WebSocket message handlers for creating and saving stories are vulnerable to injection through unsanitized input in the
componentFilePath field, potentially leading to persistent Cross-Site Scripting (XSS) or Remote Code Execution (RCE).Recommendations
Update Storybook to version 7.6.23 or later.
Update Storybook to version 8.6.17 or later.
Update Storybook to version 9.1.19 or later.
Update Storybook to version 10.2.10 or later.
Exploit
Fix
RCE
Origin Validation Error
Special Elements Injection
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Storybook