Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev server; production builds are not impacted. Exploitation requires a developer to visit a malicious website while their local Storybook dev server is running. Because the WebSocket connection does not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to the local instance without any further user interaction. If the Storybook dev server is intentionally exposed publicly (e.g. for design reviews or stakeholder demos) the risk is higher, as no malicious site visit is required. Any unauthenticated attacker can send WebSocket messages to it directly. The vulnerability affects the WebSocket message handlers for creating and saving stories. Both are vulnerable to injection via unsanitized input in the componentFilePath field, which can be exploited to achieve persistent XSS or Remote Code Execution (RCE). Versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10 contain a fix for the issue.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0165 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-27148:
    Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to     versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used     to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the     Storybook dev server; production builds are not impacted. Exploitation requires a developer to visit a     malicious website while their local Storybook dev server is running. Because the WebSocket connection does     not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to     the local instance without any further user interaction. If the Storybook dev server is intentionally     exposed publicly (e.g. for design reviews or stakeholder demos) the risk is higher, as no malicious site     visit is required. Any unauthenticated attacker can send WebSocket messages to it directly. The     vulnerability affects the WebSocket message handlers for creating and saving stories. Both are vulnerable     to injection via unsanitized input in the componentFilePath field, which can be exploited to achieve     persistent XSS or Remote Code Execution (RCE). Versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10 contain a fix     for the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to
    versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used
    to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the
    Storybook dev server; production builds are not impacted. Exploitation requires a developer to visit a
    malicious website while their local Storybook dev server is running. Because the WebSocket connection does
    not validate the origin of incoming connections, a malicious site can silently send WebSocket messages to
    the local instance without any further user interaction. If the Storybook dev server is intentionally
    exposed publicly (e.g. for design reviews or stakeholder demos) the risk is higher, as no malicious site
    visit is required. Any unauthenticated attacker can send WebSocket messages to it directly. The
    vulnerability affects the WebSocket message handlers for creating and saving stories. Both are vulnerable
    to injection via unsanitized input in the componentFilePath field, which can be exploited to achieve
    persistent XSS or Remote Code Execution (RCE). Versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10 contain a fix
    for the issue. (CVE-2026-27148)

ID	Name	Product	Family	Type	Severity
302076	TencentOS Server 4: grafana (TSSA-2026:0165)	Nessus	Tencent Local Security Checks	Local	high
438129	SCA: security update for storybook (GHSA-mjf5-7g4m-gx5w)	Tenable Cloud Security	SCA Checks	Local	high
438129	SCA: security update for storybook (GHSA-mjf5-7g4m-gx5w)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-27148

high

Tenable Plugins

high

high

high