CVE-2026-27148
Description
A flaw was found in Storybook's development server. This vulnerability allows a remote attacker to achieve Remote Code Execution or persistent Cross-Site Scripting by exploiting WebSocket hijacking. The attack can occur if a developer visits a malicious website while their local Storybook development server is active, or directly by an unauthenticated attacker if the server is publicly accessible. This is due to insufficient validation of WebSocket connection origins and unsanitized input, leading to significant security risks.
Statement
This vulnerability affects the Storybook development server, which is not intended for production deployments. Exploitation typically requires a developer to visit a malicious website while their local Storybook dev server is active. If the dev server is publicly exposed, unauthenticated attackers can directly interact with it, potentially leading to persistent cross-site scripting (XSS) or remote code execution (RCE). This primarily impacts development environments using Storybook within Red Hat AMQ, Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and Community Projects.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | 9.6 | 8.8 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | Required | Required | Required |
| Scope | Changed | Changed | Changed |
| Confidentiality | Low | High | Low |
| Integrity Impact | Low | High | Low |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
