Is CVE-2026-27148 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27148 being exploited in the wild.

How severe is CVE-2026-27148?

Critical severity, with a CVSS score of 9.6, published 25 February 2026.

Which products and versions are affected?

storybook (npm) SEMVER:introduced=8.1.0,fixed=8.6.17.

Is there a fix for CVE-2026-27148?

Yes. storybook (npm): upgrade to 8.6.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27148 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27148?

Check whether you run storybook (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27148: Storybook WebSocket hijacking and RCE in development server

CVE-2026-27148 · Severity: critical · CVSS 9.6 · Published 2026-02-25

Storybook is a popular tool used by developers to build and test website components in isolation. A security flaw in its development server allows malicious websites to hijack the connection between a developer's browser and their local Storybook instance. This could allow an attacker to steal sensitive code, modify project files, or gain full control over the developer's computer.

Technologies: storybook (npm). Vendors: npm.

Quick answers

Is CVE-2026-27148 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27148 being exploited in the wild.
How severe is CVE-2026-27148?: Critical severity, with a CVSS score of 9.6, published 25 February 2026.
Which products and versions are affected?: storybook (npm) SEMVER:introduced=8.1.0,fixed=8.6.17.
Is there a fix for CVE-2026-27148?: Yes. storybook (npm): upgrade to 8.6.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27148 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27148?: Check whether you run storybook (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

storybook (npm): upgrade to 8.6.17 or later
```
npm install storybook@8.6.17
```

Technical details

The Storybook development server's WebSocket implementation fails to validate the 'Origin' header of incoming connections, enabling Cross-Site WebSocket Hijacking (CSWSH). An attacker can lure a developer to a malicious site that silently sends WebSocket messages to the local Storybook instance. The vulnerability specifically affects message handlers for creating and saving stories, where unsanitized input in the 'componentFilePath' field allows for injection. This can be leveraged to achieve persistent XSS or Remote Code Execution (RCE). The issue is resolved by requiring authentication tokens for WebSocket connections and hardening input validation.

Affected products

storybookjs Storybook < 7.6.23, >= 8.1.0 < 8.6.17, >= 9.0.0 < 9.1.19, >= 10.0.0 < 10.2.10

Identifiers

CVE-2026-27148
GHSA-mjf5-7g4m-gx5w

Timeline

2026-02-18: patched: Fixes merged into various release branches
2026-02-25: disclosed: CVE-2026-27148 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.