Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
悪意のあるWebサイトを開発者が閲覧し操作すると、実行中のStorybookのプレビューに攻撃者の操作が届き、ストーリーファイルが不正に変更される可能性があります。変更されたファイルがローカル環境で実行されると、開発者の権限でコードが実行されるおそれがあります。影響を受けるのは8.0.0から8.6.19、9.1.21、10.6.2、11.0.0-alpha.6より前のバージョンで、8.6.19、9.1.21、10.6.2、11.0.0-alpha.6以降に修正されています。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| storybookjs | storybook | — | — |
| npm | storybook |
< 11.0.0-alpha.6 |
11.0.0-alpha.6 |
| npm | @storybook/core |
< 8.6.19 |
8.6.19 |
| npm | @storybook/core-server |
< 8.6.19 |
8.6.19 |
| npm | @storybook/experimental-addon-test |
< 8.6.19 |
8.6.19 |
| npm | @storybook/addon-vitest |
< 11.0.0-alpha.6 |
11.0.0-alpha.6 |
| npm | @storybook/addon-mcp |
< 11.0.0-alpha.6 |
11.0.0-alpha.6 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.
Who is impacted?
You are impacted if you run a Storybook dev server in the affected versions.
You are not impacted if:
- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)
- You run or visit a built version of Storybook
Recent versions of Chrome and Firefox may ask for permission before a website can connect to a localhost service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.
Recommended actions
Upgrade Storybook
Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur.
Upgrade to a patched version listed below before running storybook dev again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.
- 11.0.0-alpha.6
- 10.6.2
- 9.1.21
- 8.6.19
Review potentially breaking changes
Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-…
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
Références
- package github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web github.com
- web github.com