Skip to content
OpenAdvisories

Package · npm

@storybook/core-server

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.7
    CVE-2026-114126

    Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load…

    storybookjs storybook storybook @storybook/core-server npm
  • High 8.6
    CVE-2026-114125

    Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insuffici…

    storybookjs storybook langfuse-3-worker storybook Wolfi npm