Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-27148 is a high-severity Injection (CWE-74) vulnerability in Storybook Storybook. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-27148 is a WebSocket hijacking vulnerability in Storybook, a frontend workshop for building UI components and pages in isolation. It affects the WebSocket functionality in Storybook's dev server, which is used to create and update stories, in versions prior to 7.6.23, 8.6.17, 9.1.19, and 10.2.10. The issue stems from a lack of origin validation for incoming WebSocket connections, combined with unsanitized input in the componentFilePath field of the message handlers for creating and saving stories. This enables injection attacks leading to persistent cross-site scripting (XSS) or remote code execution (RCE). Production builds are unaffected.
Exploitation requires a developer to visit a malicious website while their local Storybook dev server is running on the default port, allowing the site to silently send WebSocket messages to the local instance without further interaction. Attackers can inject payloads via the componentFilePath field to achieve persistent XSS or RCE on the developer's machine. If the dev server is publicly exposed—for instance, for design reviews or stakeholder demos—any unauthenticated remote attacker can directly connect and send malicious messages, bypassing the need for a malicious site visit. The CVSS v3.1 score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), with associated CWEs-74 (Injection) and CWE-79 (XSS).
Mitigation is available in Storybook versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, which include fixes via commits such as 0affdf928bd6fafbadfb1dfe22ce6104805e10e8, 54689a8add18ea75d628c540f4bc677592a1e685, b8cfa77c73940c140acdcd8a06ab1ea913c44761, and d34085f39c647f5c23c3a3b2d197c18602fcf876. Security practitioners should advise developers to update to these patched versions, avoid exposing dev servers publicly, and exercise caution when visiting external sites during development sessions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8750
Vulnerability Data
Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking.…
more
This vulnerability only affects the Storybook dev server; production builds are not impacted. Exploitation requires a developer to visit a malicious website while their local Storybook dev server is running. Because the WebSocket connection does not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to the local instance without any further user interaction. If the Storybook dev server is intentionally exposed publicly (e.g. for design reviews or stakeholder demos) the risk is higher, as no malicious site visit is required. Any unauthenticated attacker can send WebSocket messages to it directly. The vulnerability affects the WebSocket message handlers for creating and saving stories. Both are vulnerable to injection via unsanitized input in the componentFilePath field, which can be exploited to achieve persistent XSS or Remote Code Execution (RCE). Versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10 contain a fix for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 1 OS baseline
V1.2.1V1.2.3V1.2.5V1.2.8
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement directly requires validating the source of data before allowing transmission or receipt.
Device identification and authentication mandates verifying the source before establishing connections.
Developer testing and evaluation can discover missing or incorrect input neutralization through targeted web-application tests.
Session authenticity mechanisms require validation that communications originate from the expected party.
SI-10 directly requires validation of information inputs to reject malformed or special-element content before it reaches downstream parsers.
Output filtering can catch or sanitize unneutralized script content before it is served to users.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Authentication directly verifies the source of users/services/hardware, mitigating origin validation failures.
Verifying identity assertions enforces origin validation for conveyed claims.
Secure SDLC practices directly require input validation and output encoding that prevent injection flaws.
Documenting authorized flows supports origin validation by defining expected sources.
Protecting networks from unauthorized access requires origin checks on communication sources.
Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches injection vulnerabilities before release.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
Logging supports detection of injection attempts but does not prevent the weakness.
Monitoring activities can identify active injection attacks after they occur.
Network security controls enforce origin validation at network boundaries.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248574 YUM must be configured to prevent the installation of patches, service packs, device drivers, or OL 8 system components that have not been digitally signed using a certificate that is recognized and approved by the organization. prevents CWE-346
- V-248575 OL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-346
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-346