Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
storybookjs/storybook
next @ 22bc8e2
20
Fixes
2
CVEs
CRITICAL
Peak severity
25.0%
Coverage
Highlights
Command Injection: 5 prior fixes. Scrutinize any change in this area.
GitHub: most-fixed (4 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cross-Site WebSocket Hijacking: Lack of origin validation in the dev server WebSocket handler allowed remote malicious sites to hijack the WebSocket channel of local developers. This is historically tracked by CVE-2026-27148.
Command Injection: Execution of system commands via spawn and execa with the shell option enabled or with direct string concatenation allowed command injection. Remediation required avoiding shell evaluation and explicitly splitting arguments.
Command Injection: GitHub Actions workflows used direct inline template expansions of untrusted git branch and ref names inside run scripts. Attackers could craft branch names containing shell metacharacters to execute arbitrary code.