CVE-2026-27148

A flaw was found in Storybook's development server. This vulnerability allows a remote attacker to achieve Remote Code Execution or persistent Cross-Site Scripting by exploiting WebSocket hijacking. The attack can occur if a developer visits a malicious website while their local Storybook development server is active, or directly by an unauthenticated attacker if the server is publicly accessible. This is due to insufficient validation of WebSocket connection origins and unsanitized input, leading to significant security risks.

This vulnerability affects the Storybook development server, which is not intended for production deployments. Exploitation typically requires a developer to visit a malicious website while their local Storybook dev server is active. If the dev server is publicly exposed, unauthenticated attackers can directly interact with it, potentially leading to persistent cross-site scripting (XSS) or remote code execution (RCE). This primarily impacts development environments using Storybook within Red Hat AMQ, Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and Community Projects.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.