AIKIDO-2026-115828
@storybook/core is vulnerable to Code Injection
96
Critical Risk
This Affects:
@storybook/coreTL;DR
The @storybook/core dev server accepts preview iframe embeds and postMessage events from other websites while it is running. A website open in the same browser can send channel events that write story files in the project, and a local test run can then execute one of those files with the developer's permissions. Patched dev servers accept embeds and channel messages only from their own origin and from loopback hosts, and they reject story writes that use unsafe names or paths outside the project.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the Storybook dev server.
Background info
@storybook/core is vulnerable to Code Injection in versions 8.0.0 - 8.6.18.
How to fix this
Upgrade the @storybook/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.