8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27148

CVE-2026-27148: Storybook Dev Server Vulnerable to WebSocket Hijacking

Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev server; production builds are not impacted. Exploitation requires a developer to visit a malicious website while their local Storybook dev server is running. Because the WebSocket connection does not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to the local instance without any further user interaction. If the Storybook dev server is intentionally exposed publicly (e.g. for design reviews or stakeholder demos) the risk is higher, as no malicious site visit is required. Any unauthenticated attacker can send WebSocket messages to it directly. The vulnerability affects the WebSocket message handlers for creating and saving stories. Both are vulnerable to injection via unsanitized input in the componentFilePath field, which can be exploited to achieve persistent XSS or Remote Code Execution (RCE). Versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10 contain a fix for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27148

CVE-2026-27148:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
storybook	npm	>= 8.1.0, < 8.6.17	8.6.17
storybook	npm	>= 8.7.0-alpha.0, < 9.1.19	9.1.19
storybook	npm	>= 10.0.0-beta.0, < 10.2.10	10.2.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-mjf5-7g4m-gx5w, is a WebSocket hijacking issue in the Storybook development server. The root cause is the lack of origin validation on the WebSocket upgrade handler, which allows a malicious website to connect to the local server without restriction.

Analysis of the provided patch commits reveals that the vulnerability is located in the ServerChannelTransport class, specifically within its constructor. This constructor is responsible for setting up the WebSocket server and its connection handling logic.

In the vulnerable versions, the constructor registers a listener for the HTTP server's upgrade event. This listener would unconditionally upgrade any connection request to the /storybook-server-channel path to a WebSocket. The patch addresses this by introducing a token-based authentication mechanism. A unique token is generated on the server and passed to the client, which must then provide this token as a query parameter (?token=...) when initiating the WebSocket connection. The upgrade handler is modified to validate this token before proceeding with the connection upgrade. If the token is missing or invalid, the connection is rejected.

The vulnerable function is identified as ServerChannelTransport.constructor because it contains the logic that sets up the insecure upgrade handler. This function would appear in a runtime profile when the Storybook dev server is initialized. The analysis of multiple patch commits confirms this finding across different versions of Storybook (7.x, 8.x, 9.x, and 10.x), with the primary difference being the file path of the affected file (code/lib/core-server/src/utils/get-server-channel.ts vs. code/core/src/core-server/utils/get-server-channel.ts).

Vulnerable functions

ServerChannelTransport.constructor

code/lib/core-server/src/utils/get-server-channel.ts

The constructor for `ServerChannelTransport` sets up a listener for the 'upgrade' event on the HTTP server. In the vulnerable version, this handler did not perform any origin or token validation for connections to the `/storybook-server-channel` endpoint. This allowed any malicious website to establish a WebSocket connection to the local Storybook dev server, leading to WebSocket hijacking. An attacker could then send malicious payloads to achieve Remote Code Execution or persistent Cross-Site Scripting.

ServerChannelTransport.constructor

code/core/src/core-server/utils/get-server-channel.ts

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.