CVE-2026-27148 is a critical (CVSS 9.6) WebSocket hijacking flaw in the Storybook dev server, which can lead to persistent XSS or remote code execution. Production builds are not affected. Upgrade to 7.6.23, 8.6.17, 9.1.19 or 10.2.10, and do not expose the dev server publicly.
What's affected
Storybook prior to 7.6.23, 8.6.17, 9.1.19 and 10.2.10, for the matching major lines. Only the dev server is affected. Built, static Storybook sites are not.
The handlers for creating and saving stories take an unsanitized componentFilePath field, and the WebSocket does not check the origin of incoming connections.
How to check if you're exposed
Check the Storybook version in each project:
npm ls storybook
npm ls --all | grep -i @storybook/core
Compare with the fixed versions for your major line. Then ask whether anyone runs the dev server on a shared or public address for design reviews. The advisory says that raises the risk, since no malicious site visit is needed in that case.
What to do now
- Upgrade Storybook to 7.6.23, 8.6.17, 9.1.19 or 10.2.10 or later, depending on your major version.
- Do not expose the dev server to the internet. Share a built static Storybook for reviews instead.
- Ask developers to avoid browsing untrusted sites while a local dev server runs until everyone has upgraded.
- Update lockfiles in every repository that uses Storybook, including internal design system repos.
- Check build and CI environments that start the dev server.
Why it matters
The record lists CWE-346 (origin validation error), CWE-79 (cross site scripting) and CWE-74 (injection). A browser lets any web page open a WebSocket to localhost. If the server does not check where the connection came from, a malicious page can send it messages silently.
This is a good example of a local only tool becoming a remote risk. The record does not mark this CVE as known exploited, and the precondition is a developer visiting a malicious site while the dev server runs.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Are production Storybook builds affected?
No. The record says only the dev server is vulnerable.
Sources
- CVE-2026-27148 on Gold
- Release listed in the record: https://github.com/storybookjs/storybook/releases/tag/v10.2.10
- Release listed in the record: https://github.com/storybookjs/storybook/releases/tag/v7.6.23
Last reviewed: 19 October 2026.
