Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Fix availableCritical · CVSS 9.4EPSS 0.38%

Published Oct 21, 2026 · updated Oct 21, 2026

What to do

  1. Upgrade to a fixed version: storybook 8.6.19, storybook 9.1.21, storybook 10.6.2, storybook 11.0.0-alpha.6 (see table).
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmstorybook

Vulnerable versions
>= 8.0.0, < 8.6.19
Fixed in
8.6.19

Check your project: npm ls storybook --all

Is storybook@8.6.19 safe to install? See the upgrade verdict →

npmstorybook

Vulnerable versions
>= 9.0.0, < 9.1.21
Fixed in
9.1.21

Check your project: npm ls storybook --all

Is storybook@9.1.21 safe to install? See the upgrade verdict →

npmstorybook

Vulnerable versions
>= 10.0.0, < 10.6.2
Fixed in
10.6.2

Check your project: npm ls storybook --all

Is storybook@10.6.2 safe to install? See the upgrade verdict →

npmstorybook

Vulnerable versions
>= 11.0.0-alpha.0, < 11.0.0-alpha.6
Fixed in
11.0.0-alpha.6

Check your project: npm ls storybook --all

Is storybook@11.0.0-alpha.6 safe to install? See the upgrade verdict →

npm@storybook/core

Vulnerable versions
>= 8.0.0, < 8.6.19
Fixed in
8.6.19

Check your project: npm ls @storybook/core --all

Is @storybook/core@8.6.19 safe to install? See the upgrade verdict →

npm@storybook/core-server

Vulnerable versions
>= 8.0.0, < 8.6.19
Fixed in
8.6.19

Check your project: npm ls @storybook/core-server --all

Is @storybook/core-server@8.6.19 safe to install? See the upgrade verdict →

npm@storybook/experimental-addon-test

Vulnerable versions
>= 8.0.0, < 8.6.19
Fixed in
8.6.19

Check your project: npm ls @storybook/experimental-addon-test --all

Is @storybook/experimental-addon-test@8.6.19 safe to install? See the upgrade verdict →

npm@storybook/addon-vitest

Vulnerable versions
>= 9.0.0, < 9.1.21
Fixed in
9.1.21

Check your project: npm ls @storybook/addon-vitest --all

Is @storybook/addon-vitest@9.1.21 safe to install? See the upgrade verdict →

npm@storybook/addon-vitest

Vulnerable versions
>= 10.0.0, < 10.6.2
Fixed in
10.6.2

Check your project: npm ls @storybook/addon-vitest --all

Is @storybook/addon-vitest@10.6.2 safe to install? See the upgrade verdict →

npm@storybook/addon-vitest

Vulnerable versions
>= 11.0.0-alpha.0, < 11.0.0-alpha.6
Fixed in
11.0.0-alpha.6

Check your project: npm ls @storybook/addon-vitest --all

Is @storybook/addon-vitest@11.0.0-alpha.6 safe to install? See the upgrade verdict →

npm@storybook/addon-mcp

Vulnerable versions
>= 10.6.0, < 10.6.2
Fixed in
10.6.2

Check your project: npm ls @storybook/addon-mcp --all

Is @storybook/addon-mcp@10.6.2 safe to install? See the upgrade verdict →

npm@storybook/addon-mcp

Vulnerable versions
>= 11.0.0-alpha.0, < 11.0.0-alpha.6
Fixed in
11.0.0-alpha.6

Check your project: npm ls @storybook/addon-mcp --all

Is @storybook/addon-mcp@11.0.0-alpha.6 safe to install? See the upgrade verdict →

What changed

  1. Oct 21, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · CWE-94 Improper Control of Generation of Code ('Code Injection') · CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') · CWE-346 Origin Validation Error · CWE-441 Unintended Proxy or Intermediary ('Confused Deputy') · CWE-749 Exposed Dangerous Method or Function · CWE-862 Missing Authorization · CWE-1021 Improper Restriction of Rendered UI Layers or Frames

← All critical vulnerabilities