PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-27148] Persistent XSS/RCE using WebSockets in Storybook’s dev server

aikido.dev | blog | CVE-2026-27148 | #ai-security | #rce | #xss | #cve | #websocket | #ai-pentesting | #storybook
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A WebSocket hijacking flaw in Storybook's dev server (CVE-2026-27148, CVSS 8.9) enables persistent XSS and RCE that could reach production builds. Patched in 7.6.23, 8.6.17, 9.1.19, and 10.2.10.
CVE
CVE-2026-27148
Published
Collected

Related coverage

blog · aikido.dev
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
tool · github.com
Assetnote Releases php2shell-scanner: High-Fidelity Scanner for CVE-2026-109618 & CVE-2026-109619
As php2shell affects widespread PHP installations globally, this production-grade scanning logic enables enterprise security teams and defenders to reliably audit attack surfaces without relying on destructive exploit payloads.
Back