Skip to main content
cve.nowby Sazabi
← npm
npmPackage

storybook

4 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

Latest release
10.6.6 (Nov 5, 2026): no advisory affects it
Newest unaffected release
10.6.6 (Nov 5, 2026), the latest release
Advisories
4 · 4 high
Weekly downloads
34.9M
Dependents
177
Releases
500+ since 7.6.23 (Feb 18, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-114126
    Affects 8.6.17 to 8.6.18 (8.6.19 is outside it); 9.1.19 to 9.1.20 (9.1.21 is outside it); 10.2.10 to 10.6.1 (10.6.2 is outside it); 11.0.0-alpha.0 to 11.0.0-alpha.5 (11.0.0-alpha.6 is outside it)
  • CVE-2026-114125
    Affects 8.6.17 to 8.6.18 (8.6.19 is outside it); 9.1.19 to 9.1.20 (9.1.21 is outside it); 10.2.10 to 10.6.1 (10.6.2 is outside it); 11.0.0-alpha.0 to 11.0.0-alpha.5 (11.0.0-alpha.6 is outside it)
  • CVE-2026-27148
    No published release is affected
    No published release is affected
  • CVE-2025-68429
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 4

  • Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

    Affected: from 8.0.0, fixed in 8.6.19; from 9.0.0, fixed in 9.1.21; from 10.0.0, fixed in 10.6.2; from 11.0.0-alpha.0, fixed in 11.0.0-alpha.6.

    Fixed in 8.6.19 (released Oct 12, 2026, 9 days before disclosure), 9.1.21 (released Oct 12, 2026, 9 days before disclosure), 10.6.2 (released Oct 12, 2026, 9 days before disclosure) and 1 other version.

    The latest release, 10.6.6, is not affected.

    51% of storybook downloads last week were affected versions (19.3M).

  • Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

    Affected: from 8.0.0, fixed in 8.6.19; from 9.0.0, fixed in 9.1.21; from 10.0.0, fixed in 10.6.2; from 11.0.0-alpha.0, fixed in 11.0.0-alpha.6.

    Fixed in 8.6.19 (released Oct 12, 2026, 9 days before disclosure), 9.1.21 (released Oct 12, 2026, 9 days before disclosure), 10.6.2 (released Oct 12, 2026, 9 days before disclosure) and 1 other version.

    The latest release, 10.6.6, is not affected.

    51% of storybook downloads last week were affected versions (19.3M).

  • Storybook Dev Server Vulnerable to WebSocket Hijacking

    Affected: from 8.1.0, fixed in 8.6.17; from 8.7.0-alpha.0, fixed in 9.1.19; from 10.0.0-beta.0, fixed in 10.2.10.

    Fixed in 8.6.17 (released Feb 18, 2026, 7 days before disclosure), 9.1.19 (released Feb 18, 2026, 7 days before disclosure) and 10.2.10 (released Feb 18, 2026, 7 days before disclosure).

    The latest release, 10.6.6, is not affected.

    15% of storybook downloads last week were affected versions (5.5M).

  • Storybook manager bundle may expose environment variables during build

    Affected: from 7.0.0, fixed in 7.6.21; from 8.0.0, fixed in 8.6.15; from 9.0.0, fixed in 9.1.17; from 10.0.0, fixed in 10.1.10.

    Fixed in 7.6.23 (released Feb 18, 2026, 63 days after disclosure, the advisory names 7.6.21, which was never published), 8.6.17 (released Feb 18, 2026, 63 days after disclosure, the advisory names 8.6.15, which was never published), 9.1.19 (released Feb 18, 2026, 63 days after disclosure, the advisory names 9.1.17, which was never published) and 1 other version.

    The latest release, 10.6.6, is not affected.

    14% of storybook downloads last week were affected versions (5.5M).