Më 21 tetor 2026, GitHub publikoi këshillën e sigurisë GHSA-f2ph-cmg5-wxc8 (CVE-2026-114125) për një dobësi me rrezikshmëri kritike (CVSS 9.4) në paketën storybook të ekosistemit npm. Dobësia prek gjithsej 12 paketa.
Paketat e prekura
- storybook (npm) — versionet e prekura:
>= 8.0.0, < 8.6.19; versioni me rregullim:8.6.19 - storybook (npm) — versionet e prekura:
>= 9.0.0, < 9.1.21; versioni me rregullim:9.1.21 - storybook (npm) — versionet e prekura:
>= 10.0.0, < 10.6.2; versioni me rregullim:10.6.2 - storybook (npm) — versionet e prekura:
>= 11.0.0-alpha.0, < 11.0.0-alpha.6; versioni me rregullim:11.0.0-alpha.6 - @storybook/core (npm) — versionet e prekura:
>= 8.0.0, < 8.6.19; versioni me rregullim:8.6.19 - @storybook/core-server (npm) — versionet e prekura:
>= 8.0.0, < 8.6.19; versioni me rregullim:8.6.19 - @storybook/experimental-addon-test (npm) — versionet e prekura:
>= 8.0.0, < 8.6.19; versioni me rregullim:8.6.19 - @storybook/addon-vitest (npm) — versionet e prekura:
>= 9.0.0, < 9.1.21; versioni me rregullim:9.1.21
Detaje
- Rrezikshmëria: Kritike (CVSS 9.4)
- CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-96 (Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')), CWE-346 (Origin Validation Error), CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy')), CWE-749 (Exposed Dangerous Method or Function), CWE-862 (Missing Authorization), CWE-1021 (Improper Restriction of Rendered UI Layers or Frames)
- Identifikuesit: GHSA-f2ph-cmg5-wxc8, CVE-2026-114125
Përmbledhja zyrtare (në anglisht)
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites — Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: – You run a dev server that you…
Çfarë duhet të bëni
Nëse projektet tuaja përdorin storybook, përditësojeni sa më shpejt në versionin 8.6.19 ose më të ri.
