Storybook’s development server accepts WebSocket connections without validating the connection’s origin. This omission enables an attacker to hijack the local server by visiting a malicious website, or, if the server is publicly exposed, by directly connecting without authorization. The hijacked connection can send crafted messages containing unsanitized input to the componentFilePath field of story creation or saving endpoints. The unsafe handling of this field allows injection that can lead to persistent cross‑site scripting or, in some cases, remote code execution against the machine running the dev server.

The vulnerability affects Storybook versions earlier than 7.6.23, 8.6.17, 9.1.19, and 10.2.10. These releases are hosted on node.js environments and are commonly used by front‑end developers for local prototype and design‑review sessions.

The likely attack vector is deduced from the description; the attacker may hijack the dev server by visiting a malicious site while the server is running, or, if the dev server is exposed publicly, directly connect without needing the developer to visit a site. The CVSS score of 8.9 categorizes the flaw as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at the present time. It is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. If the dev server is inadvertently exposed to the public internet, the risk rises significantly as the attacker can connect without needing to compromise the developer’s machine directly.