---
id: 2453
title: "[CVE-2026-27148] Persistent XSS/RCE using WebSockets in Storybook’s dev server"
cve: CVE-2026-27148
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/storybooks-websockets-attack"
published_at: "2026-03-03 00:00"
tags: ["ai-security", "rce", "xss", "cve", "websocket", "ai-pentesting", "storybook"]
phying_url: "https://phying.com/item/2453"
lang: en
---

# [CVE-2026-27148] Persistent XSS/RCE using WebSockets in Storybook’s dev server

## Summary

A WebSocket hijacking flaw in Storybook's dev server (CVE-2026-27148, CVSS 8.9) enables persistent XSS and RCE that could reach production builds. Patched in 7.6.23, 8.6.17, 9.1.19, and 10.2.10.

## Intelligence Metadata

- **Sources:** aikido.dev
- **CVE:** CVE-2026-27148
- **Published:** 2026-03-03 00:00
- **Original:** https://www.aikido.dev/blog/storybooks-websockets-attack
- **Phying News:** https://phying.com/item/2453