Go to packages list

storybook

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 1CriticalAffects 4 versions
  • 3HighAffects 11 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
4vulnerabilities
  • Critical1 (25.0%)
  • High3 (75.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 1
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (4)

Known vulnerabilities affecting storybook, based on data from OSV.

Vulnerabilities affecting storybook
IDSeveritySummaryAffected versionsPublishedSource
GHSA-px85-f4q5-jh77HighStorybook dev server vulnerable to code injection from the local network**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN. ## Who is impacted? You are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact
  • >= 8.0.0, < 8.6.19
  • >= 9.0.0, < 9.1.21
  • >= 10.0.0, < 10.6.2
  • >= 11.0.0-alpha.0, < 11.0.0-alpha.6
GitHub (opens in a new tab)
GHSA-f2ph-cmg5-wxc8CriticalStorybook: Missing origin validation in Storybook preview allows code injection from malicious websites**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. ## Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook R
  • >= 8.0.0, < 8.6.19
  • >= 9.0.0, < 9.1.21
  • >= 10.0.0, < 10.6.2
  • >= 11.0.0-alpha.0, < 11.0.0-alpha.6
GitHub (opens in a new tab)
GHSA-mjf5-7g4m-gx5wHighStorybook Dev Server is Vulnerable to WebSocket Hijacking### Summary The WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability **only affects the Storybook dev server; production builds are not impacted**. ### Details Exploitation requires a developer to visit a malicious website while their local Storybook dev server is running. Because the WebSocket connection does not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to the local instance without any further user interaction. If a Storybook dev server is in
  • >= 8.1.0, < 8.6.17
  • >= 8.7.0-alpha.0, < 9.1.19
  • >= 10.0.0-beta.0, < 10.2.10
GitHub (opens in a new tab)
GHSA-8452-54wp-rmv6HighStorybook manager bundle may expose environment variables during buildOn December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks. The vulnerability is a bug in how Storybook handles environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. If those variables contained secrets, they
  • >= 7.0.0, < 7.6.21
  • >= 8.0.0, < 8.6.15
  • >= 9.0.0, < 9.1.17
  • >= 10.0.0, < 10.1.10
GitHub (opens in a new tab)
  • GHSA-px85-f4q5-jh77High
    Storybook dev server vulnerable to code injection from the local network
    • >= 8.0.0, < 8.6.19
    • >= 9.0.0, < 9.1.21
    • +2 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 8.0.0, < 8.6.19
    • >= 9.0.0, < 9.1.21
    • >= 10.0.0, < 10.6.2
    • >= 11.0.0-alpha.0, < 11.0.0-alpha.6

    **Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN. ## Who is impacted? You are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact

    CVE: CVE-2026-114126

  • GHSA-f2ph-cmg5-wxc8Critical
    Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
    • >= 8.0.0, < 8.6.19
    • >= 9.0.0, < 9.1.21
    • +2 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 8.0.0, < 8.6.19
    • >= 9.0.0, < 9.1.21
    • >= 10.0.0, < 10.6.2
    • >= 11.0.0-alpha.0, < 11.0.0-alpha.6

    **Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. ## Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook R

    CVE: CVE-2026-114125

  • GHSA-mjf5-7g4m-gx5wHigh
    Storybook Dev Server is Vulnerable to WebSocket Hijacking
    • >= 8.1.0, < 8.6.17
    • >= 8.7.0-alpha.0, < 9.1.19
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 8.1.0, < 8.6.17
    • >= 8.7.0-alpha.0, < 9.1.19
    • >= 10.0.0-beta.0, < 10.2.10

    ### Summary The WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability **only affects the Storybook dev server; production builds are not impacted**. ### Details Exploitation requires a developer to visit a malicious website while their local Storybook dev server is running. Because the WebSocket connection does not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to the local instance without any further user interaction. If a Storybook dev server is in

    CVE: CVE-2026-27148

  • GHSA-8452-54wp-rmv6High
    Storybook manager bundle may expose environment variables during build
    • >= 7.0.0, < 7.6.21
    • >= 8.0.0, < 8.6.15
    • +2 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 7.0.0, < 7.6.21
    • >= 8.0.0, < 8.6.15
    • >= 9.0.0, < 9.1.17
    • >= 10.0.0, < 10.1.10

    On December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks. The vulnerability is a bug in how Storybook handles environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. If those variables contained secrets, they

    CVE: CVE-2025-68429

Showing 1-4 of 4 vulnerabilities