storybook vulnerabilities
CVEs whose affected-version data names the storybook package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-114126High· 8.7Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token t…
▾ Twilightstorybookjs · storybookvia CVEORG
CVE-2026-114125Critical· 8.6Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
▾ Midnightstorybook · storybookvia GHSA