2vulnerabilities
- Critical1 (50.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
storybook-addon-mcp
Ecosystem: npm
Downloads: 11.32 Mln
- 1CriticalAffects 2 versions
- 1HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 2 vulnerabilities
- Critical: 1
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting storybook-addon-mcp, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-px85-f4q5-jh77 | High | Storybook dev server vulnerable to code injection from the local network**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN. ## Who is impacted? You are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact |
| GitHub (opens in a new tab) | |
| GHSA-f2ph-cmg5-wxc8 | Critical | Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. ## Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook R |
| GitHub (opens in a new tab) |
- GHSA-px85-f4q5-jh77HighStorybook dev server vulnerable to code injection from the local network
>= 10.6.0, < 10.6.2>= 11.0.0-alpha.0, < 11.0.0-alpha.6
**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN. ## Who is impacted? You are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact
CVE: CVE-2026-114126
- GHSA-f2ph-cmg5-wxc8CriticalStorybook: Missing origin validation in Storybook preview allows code injection from malicious websites
>= 10.6.0, < 10.6.2>= 11.0.0-alpha.0, < 11.0.0-alpha.6
**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. ## Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook R
CVE: CVE-2026-114125