storybook

10.6.5 · 27 Oct 2026MIT22.3M / weekRepository Homepage npm Atom feed

Your version

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Line	Newest	Where it stands
	10.6.5	Safe from 10.6.2
	9.1.21	Safe from 9.1.21
	8.6.19	Safe from 8.6.19
	7.6.24	Safe from 7.6.21

Critical
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitesGHSA-f2ph-cmg5-wxc8 · 21 Oct 2026
fixed in 10.6.2, 9.1.21, 8.6.19
High
Storybook dev server vulnerable to code injection from the local networkGHSA-px85-f4q5-jh77 · 22 Oct 2026
fixed in 10.6.2, 9.1.21, 8.6.19
High
Storybook Dev Server is Vulnerable to WebSocket HijackingGHSA-mjf5-7g4m-gx5w · 26 Feb 2026
fixed in 10.2.10, 9.1.19, 8.6.17
High
Storybook manager bundle may expose environment variables during buildGHSA-8452-54wp-rmv6 · 18 Dec 2025
fixed in 10.1.10, 9.1.17, 8.6.15 +1

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 28 Oct 2026. Releases and advisories last read 28 Oct 2026.