Description
Summary: The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files.
Recommendation
Update the storybook package to the latest compatible version. Followings are version details:
Affected version(s): **>= 11.0.0-alpha.0, < 11.0.0-alpha.6 >= 10.0.0, < 10.6.2 >= 9.0.0, < 9.1.21 >= 8.0.0, < 8.6.19** Patched version(s): **11.0.0-alpha.6 10.6.2 9.1.21 8.6.19**
References
Could your website be exposed too?
SmartScanner can check your website for Storybook dev server vulnerable to code injection from the local network and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Storybook Dev Server is Vulnerable to WebSocket Hijacking - CVE-2026-27148
- lodash vulnerable to Code Injection via `_.template` imports key names - CVE-2026-4800
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites - CVE-2026-114125
- lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es - CVE-2026-4800
You might also like:
See something that needs correcting? Let us knowUpdated October 22, 2026