Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@storybook/addon-vitest

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release
10.6.6 (Nov 5, 2026): no advisory affects it
Newest unaffected release
10.6.6 (Nov 5, 2026), the latest release
Advisories
2 · 2 high
Weekly downloads
9M
Dependents
32
Releases
500+ since 9.1.18 (Feb 17, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-114126
    Affects 9.1.18 to 9.1.20 (9.1.21 is outside it); 10.2.9 to 10.6.1 (10.6.2 is outside it); 11.0.0-alpha.0 to 11.0.0-alpha.5 (11.0.0-alpha.6 is outside it)
  • CVE-2026-114125
    Affects 9.1.18 to 9.1.20 (9.1.21 is outside it); 10.2.9 to 10.6.1 (10.6.2 is outside it); 11.0.0-alpha.0 to 11.0.0-alpha.5 (11.0.0-alpha.6 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

  • Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

    Affected: from 9.0.0, fixed in 9.1.21; from 10.0.0, fixed in 10.6.2; from 11.0.0-alpha.0, fixed in 11.0.0-alpha.6.

    Fixed in 9.1.21 (released Oct 12, 2026, 9 days before disclosure), 10.6.2 (released Oct 12, 2026, 9 days before disclosure) and 11.0.0-alpha.6 (released Oct 12, 2026, 9 days before disclosure).

    The latest release, 10.6.6, is not affected.

    41% of @storybook/addon-vitest downloads last week were affected versions (3.9M).

  • Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

    Affected: from 9.0.0, fixed in 9.1.21; from 10.0.0, fixed in 10.6.2; from 11.0.0-alpha.0, fixed in 11.0.0-alpha.6.

    Fixed in 9.1.21 (released Oct 12, 2026, 9 days before disclosure), 10.6.2 (released Oct 12, 2026, 9 days before disclosure) and 11.0.0-alpha.6 (released Oct 12, 2026, 9 days before disclosure).

    The latest release, 10.6.6, is not affected.

    41% of @storybook/addon-vitest downloads last week were affected versions (3.9M).