Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/22829?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/22829?format=api", "vulnerability_id": "VCID-8f4b-4t1m-1bdf", "summary": "Storybook Dev Server is Vulnerable to WebSocket Hijacking\nThe WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability **only affects the Storybook dev server; production builds are not impacted**.", "aliases": [ { "alias": "CVE-2026-27148" }, { "alias": "GHSA-mjf5-7g4m-gx5w" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73106?format=api", "purl": "pkg:npm/storybook@10.2.10", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/storybook@10.2.10" }, { "url": "http://public2.vulnerablecode.io/api/packages/73104?format=api", "purl": "pkg:npm/storybook@8.6.17", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/storybook@8.6.17" }, { "url": "http://public2.vulnerablecode.io/api/packages/73105?format=api", "purl": "pkg:npm/storybook@9.1.19", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/storybook@9.1.19" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73103?format=api", "purl": "pkg:npm/storybook@10.0.0-beta.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8f4b-4t1m-1bdf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/storybook@10.0.0-beta.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/73101?format=api", "purl": "pkg:npm/storybook@8.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8f4b-4t1m-1bdf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/storybook@8.1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/73102?format=api", "purl": "pkg:npm/storybook@8.7.0-alpha.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8f4b-4t1m-1bdf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/storybook@8.7.0-alpha.0" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-27148", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00075", "scoring_system": "epss", "scoring_elements": "0.22649", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-27148" }, { "reference_url": "https://github.com/storybookjs/storybook", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook" }, { "reference_url": "https://github.com/storybookjs/storybook/commit/0affdf928bd6fafbadfb1dfe22ce6104805e10e8", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook/commit/0affdf928bd6fafbadfb1dfe22ce6104805e10e8" }, { "reference_url": "https://github.com/storybookjs/storybook/commit/54689a8add18ea75d628c540f4bc677592a1e685", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook/commit/54689a8add18ea75d628c540f4bc677592a1e685" }, { "reference_url": "https://github.com/storybookjs/storybook/commit/b8cfa77c73940c140acdcd8a06ab1ea913c44761", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook/commit/b8cfa77c73940c140acdcd8a06ab1ea913c44761" }, { "reference_url": "https://github.com/storybookjs/storybook/commit/d34085f39c647f5c23c3a3b2d197c18602fcf876", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook/commit/d34085f39c647f5c23c3a3b2d197c18602fcf876" }, { "reference_url": "https://github.com/storybookjs/storybook/releases/tag/v10.2.10", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook/releases/tag/v10.2.10" }, { "reference_url": "https://github.com/storybookjs/storybook/releases/tag/v7.6.23", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook/releases/tag/v7.6.23" }, { "reference_url": "https://github.com/storybookjs/storybook/releases/tag/v8.6.17", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook/releases/tag/v8.6.17" }, { "reference_url": "https://github.com/storybookjs/storybook/releases/tag/v9.1.19", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook/releases/tag/v9.1.19" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27148", "reference_id": "CVE-2026-27148", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27148" }, { "reference_url": "https://github.com/advisories/GHSA-mjf5-7g4m-gx5w", "reference_id": "GHSA-mjf5-7g4m-gx5w", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-mjf5-7g4m-gx5w" }, { "reference_url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-mjf5-7g4m-gx5w", "reference_id": "GHSA-mjf5-7g4m-gx5w", "reference_type": "", "scores": [], "url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-mjf5-7g4m-gx5w" } ], "weaknesses": [ { "cwe_id": 1385, "name": "Missing Origin Validation in WebSockets", "description": "The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid." }, { "cwe_id": 74, "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "description": "The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component." }, { "cwe_id": 79, "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "description": "The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8f4b-4t1m-1bdf" }