Curated security research, vulnerabilities, advisories and tools for practitioners.

← back | CVE Intelligence

CVE-2026-27148

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-27148.

Coverage Span: 2026-03-03
Reports: 1 related reports

Associated Reports & Timeline

Persistent XSS/RCE using WebSockets in Storybook’s dev server

aikido.dev | blog | 2026-03-03 00:00 | original ↗ | #ai-security | #rce | #xss | #cve

A WebSocket hijacking flaw in Storybook's dev server (CVE-2026-27148, CVSS 8.9) enables persistent XSS and RCE that could reach production builds. Patched in 7.6.23, 8.6.17, 9.1.19, and 10.2.10.