@storybook/addon-mcp vulnerabilities (npm)

2 vulnerabilities.

• @storybook/addon-mcp npm Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files CVE-2026-114126 Fix available 8.7 HighOctober 21, 2026
• @storybook/addon-mcp npm Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites CVE-2026-114125 Fix available 8.6 HighOctober 21, 2026