CVE-2026-27148: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27148 is a WebSocket hijacking vulnerability in Storybook's development server that allows attackers to inject malicious payloads via unsanitized input, leading to persistent Cross-Site Scripting (XSS) or Remote Code Execution (RCE). It affects Storybook (npm) versions prior to 7.6.23, 8.6.17 (for the 8.1.0+ branch), 9.1.19 (for the 9.0.0+ branch), and 10.2.10 (for the 10.0.0+ branch); production builds are not impacted. The vulnerability was disclosed on February 25, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 9.6 (Critical) and a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a missing origin validation on the Storybook dev server's WebSocket endpoint (/storybook-server-channel), classified under CWE-74 (Injection) and CWE-79 (Cross-Site Scripting). Because the WebSocket server accepted upgrade requests from any origin without authentication, a malicious website visited by a developer could silently establish a WebSocket connection to the locally running Storybook instance. The WebSocket message handlers for creating and saving stories failed to sanitize the componentFilePath field, enabling injection of arbitrary content directly into story source files. The fix introduced a UUID-based secret token (wsToken) generated at server startup via node:crypto's randomUUID(), which must be supplied as a query parameter (?token=<wsToken>) on WebSocket upgrade requests; connections without a valid token receive an HTTP 403 and are destroyed (GitHub Advisory, Patch Commit v9.1.19).

Successful exploitation can result in persistent XSS — where malicious payloads are written directly into story source files and, if committed to version control, propagate to deployed Storybook documentation sites and CI/CD pipelines. In non-default configurations (e.g., stories executed via portable stories in JSDOM), server-side RCE is possible, enabling credential and environment variable exfiltration, source code and filesystem access, backdoor installation, and lateral movement to internal network resources. The advisory explicitly notes supply chain risk: injected code can spread to other team members via git and affect shared component libraries across multiple projects (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.47%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires either a developer to visit a malicious website while their local Storybook dev server is running, or — in the higher-risk scenario — direct unauthenticated network access to a publicly exposed Storybook dev server. Note that recent versions of Chrome have partial protections against cross-origin WebSocket connections, while Firefox does not (GitHub Advisory).

1. Reconnaissance: Identify a target developer running a Storybook dev server locally (default port 6006) or a publicly exposed instance (e.g., via Shodan/Censys searching for storybook-server-channel or port 6006).
2. Craft malicious page: Create a web page containing JavaScript that initiates a WebSocket connection to ws://localhost:6006/storybook-server-channel (for local targets) or the public IP/hostname.
3. Lure developer (local attack): Host the malicious page and trick the target developer into visiting it while their Storybook dev server is running. For publicly exposed servers, this step is unnecessary.
4. Establish WebSocket connection: The malicious page's JavaScript opens a WebSocket to the Storybook dev server. Because no origin validation exists in vulnerable versions, the connection is accepted without authentication.
5. Send malicious message: Craft a WebSocket message targeting the story creation or save handler, injecting a malicious payload into the componentFilePath field — for example, embedding XSS script tags or a Node.js RCE payload.
6. Achieve persistent XSS or RCE: The unsanitized componentFilePath value is written into a story source file on disk. If the story is rendered, the XSS payload executes in the browser. In JSDOM-based configurations, the payload may execute server-side, enabling RCE with access to credentials, environment variables, and the filesystem.
7. Supply chain propagation: If the developer commits the modified story file, the injected payload spreads to other team members via git and executes in CI/CD pipelines (GitHub Advisory).

• Network: Unexpected WebSocket upgrade requests to /storybook-server-channel from origins other than localhost or the expected development host; outbound connections from the Storybook dev server process to unknown external IPs.
• File System: Unexpected or modified story source files (.stories.js, .stories.ts, .stories.tsx, etc.) containing script tags, encoded payloads, or unusual componentFilePath values; new or modified files in the Storybook project directory not matching recent developer activity.
• Logs: Dev server access logs showing WebSocket upgrade requests from unexpected origins or IP addresses; HTTP 403 responses to /storybook-server-channel (post-patch, indicating attempted exploitation against patched servers).
• Process: Unusual child processes spawned by the Node.js Storybook dev server process (e.g., sh, bash, curl, wget, python) that are not part of normal build activity.
• Version Control: Unexpected commits modifying story files with unusual content in componentFilePath fields or embedded script payloads (GitHub Advisory).

Update Storybook to one of the patched versions: 7.6.23, 8.6.17, 9.1.19, or 10.2.10, depending on your current version branch. The fix introduces a cryptographically random UUID token (wsToken) required for all WebSocket connections to the dev server, validated using constant-time comparison to prevent timing attacks. As an immediate workaround prior to patching, do not expose the Storybook dev server publicly (restrict to localhost or trusted networks only), and ensure developers avoid visiting untrusted websites while running local Storybook dev servers. IBM Guardium Data Security Center users should refer to the IBM security bulletin for additional guidance (GitHub Advisory, IBM Advisory).

The vulnerability was discovered and reported by Aikido Security (credited as finder), with additional reporters grumpinout1 and JorianWoltjer (GitHub Advisory). Aikido Security published a technical blog post detailing the WebSocket attack vector (Aikido Blog). The Storybook maintainers responded rapidly, releasing patches across all supported major version branches on the same day as disclosure. IBM subsequently issued a security bulletin acknowledging that IBM Guardium Data Security Center is affected (IBM Advisory).