Executive brief
Storybook is a popular tool used by developers to build and test website components in isolation. A security flaw in its development server allows malicious websites to hijack the connection between a developer's browser and their local Storybook instance. This could allow an attacker to steal sensitive code, modify project files, or gain full control over the developer's computer.
Technical details
The Storybook development server's WebSocket implementation fails to validate the 'Origin' header of incoming connections, enabling Cross-Site WebSocket Hijacking (CSWSH). An attacker can lure a developer to a malicious site that silently sends WebSocket messages to the local Storybook instance. The vulnerability specifically affects message handlers for creating and saving stories, where unsanitized input in the 'componentFilePath' field allows for injection. This can be leveraged to achieve persistent XSS or Remote Code Execution (RCE). The issue is resolved by requiring authentication tokens for WebSocket connections and hardening input validation.
Affected products
- storybookjs Storybook < 7.6.23, >= 8.1.0 < 8.6.17, >= 9.0.0 < 9.1.19, >= 10.0.0 < 10.2.10
Timeline
- 2026-02-18: patched: Fixes merged into various release branches
- 2026-02-25: disclosed: CVE-2026-27148 published
References
- https://github.com/storybookjs/storybook/commit/0affdf928bd6fafbadfb1dfe22ce6104805e10e8
- https://github.com/storybookjs/storybook/commit/54689a8add18ea75d628c540f4bc677592a1e685
- https://github.com/storybookjs/storybook/commit/b8cfa77c73940c140acdcd8a06ab1ea913c44761
- https://github.com/storybookjs/storybook/commit/d34085f39c647f5c23c3a3b2d197c18602fcf876
- https://github.com/storybookjs/storybook/releases/tag/v10.2.10
- https://github.com/storybookjs/storybook/releases/tag/v7.6.23
- https://github.com/storybookjs/storybook/releases/tag/v8.6.17