Login Request a demo
ST
Product
storybook
by storybookjs · last CVE Oct 21, 2026
4
CVEs
0
On KEV
9.6
Max CVSS
2
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 1High 2Medium 1Low 0
Severity
All severities4Critical1High2Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add storybook to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-27148
9.6
1%
Feb 25
Storybook Dev Server Vulnerable to WebSocket Hijacking
Affected: < 7.6.23; >= 8.1.0, < 8.6.17; >= 9.0.0, < 9.1.19; >= 10.0.0, < 10.2.10
CVE-2026-114126
8.7
1%
Oct 21
Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files
Affected: >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6
CVE-2026-114125
8.6
0%
Oct 21
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Affected: >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6
CVE-2025-68429
5.3
0%
Dec 17
Storybook manager bundle may expose environment variables during build
Affected: >= 7.0.0, < 7.6.21; >= 8.0.0, < 8.6.15; >= 9.0.0, < 9.1.17; >= 10.0.0, < 10.1.10
Showing 4