Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN. Who is impacted? You are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact of this advisory is more important if you have the Vitest addon installed and are using an old version of Vitest. You are not impacted if: - You run a dev server in an environment that other devices on your network cannot reach (e.g. a container that does not publish the Storybook port, or publishes it only on 127.0.0.1) - You run a dev server whilst connected to a trusted local network - You serve a…
Recommended action: Upgrade to 8.6.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook Recent versions of Chrome and Firefox may ask for permission before a website can connect to a localhost service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust. Recommended actions Upgrade Storybook Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario…
Recommended action: Upgrade to 8.6.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.