GHSA-mjf5-7g4m-gx5w
NoneCVSS
—
EPSS
—
Published
Feb 26, 2026
CISA due date
—
The record
Storybook Dev Server is Vulnerable to WebSocket Hijacking
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | storybook | 10.0.0-beta.0 | 10.2.10 |
| npm | storybook | 8.1.0 | 8.6.17 |
| npm | storybook | 8.7.0-alpha.0 | 9.1.19 |
Related vulnerabilities
- CVE-2026-27148 Storybook is a frontend workshop for building user interface components and pages in… Same vulnerability
- GHSA-8452-54wp-rmv6 Storybook manager bundle may expose environment variables during build Also affects storybook
- CVE-2025-68429 Storybook is a frontend workshop for building user interface components and pages in… Also affects storybook
- CVE-2026-85183 Taipy configures its socket.io server with wildcard CORS origin and credential flag… CWE-1385
- CVE-2026-59950 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-1385
- CVE-2026-57111 Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest… CWE-1385
- CVE-2026-10054 In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes… CWE-1385
- CVE-2026-44211 Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. CWE-1385