storybook
v10.6.7Storybook is the industry standard workshop for building, documenting, and testing UI components in isolation
- Maintenance
- Active5967 commits in 3 months · bus factor 4
- License
- MITPermissive · OSI-approved
- Security
- 4 advisories1 critical, 3 high · Scorecard 7.2/10
- Supported versions
- No scheduleendoflife.date does not track this project
91.6k stars · 10.5k forks · 1.8k open issues · last release 5 days ago · data checked 5 hours ago
Security advisories
All advisories on GitHubThe 4 most recent advisories published by the maintainers: 1 critical, 3 high. Check the patched version against the one you run.
- criticalCVE-2026-114125Oct 12, 2026Storybook dev server preview allows code injection from malicious websites
- Affected
- >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6; >= 10.6.0, < 10.6.2
- Patched in
- 8.6.19; 9.1.21; 10.6.2; 11.0.0-alpha.6
- highCVE-2026-114126Oct 12, 2026Storybook dev server vulnerable to code injection from the local network
- Affected
- >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6; >= 10.6.0, < 10.6.2
- Patched in
- 8.6.19; 9.1.21; 10.6.2; 11.0.0-alpha.6
- highCVE-2026-27148Feb 25, 2026Storybook dev server vulnerable to WebSocket hijacking
- Affected
- >= 8.1.0 and < 10.2.10
- Patched in
- 7.6.23, 8.6.17, 9.1.19, 10.2.10
- highCVE-2025-68429Dec 17, 2025Exposure of environment variables from .env in published Storybook
- Affected
- >7.0.0
- Patched in
- 7.6.21, 8.6.15, 9.1.17, 10.1.10