Provenance Record

Clear News structure (Overview, What the Advisories Describe, Who Is Affected, Default Behavior Changes, What Is Not Known). Title is 117 characters (cap 150) and the body is 830 words raw and 830 with link URLs stripped, inside the News range of 400-1200. No policy violation. No internal links (zero '](/' occurrences); all five links are allowlisted github.com URLs. No proof-of-concept detail or operational attack instructions: the attack mechanics are reproduced only at the level the vendor advisories publish, and the only commands/flags quoted are mitigations (--host, core.allowedHosts, feature flags). Freshness is stated (advisories and releases dated October 12, 2026; article dated October 13).

All five snapshots exist, are 30-35 KB gzipped, return status 200 and contain the page body (not page chrome); manifest suspicious_patterns is null for all five, so no pattern hits to adjudicate. source-0 (GHSA-f2ph-cmg5-wxc8) and source-1 (GHSA-px85-f4q5-jh77) were read in full and cross-checked against the GitHub REST API (repos/storybookjs/storybook/security-advisories/<id>). GHSA-f2ph-cmg5-wxc8: severity critical; cve_id null ('No known CVE'); CVSS v4 9.4, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; CWE-22, 96, 346, 441, 749, 862, 1021; storybook affected >=8.0.0 <8.6.19, >=9.0.0 <9.1.21, >=10.0.0 <10.6.2, >=11.0.0-alpha.0 <11.0.0-alpha.6 with those patched versions; addon-mcp affected only in 10.6.x and 11 alpha; reporter agent-killjoy, coordinator Sidnioulz, remediation developer ghengeveld; published 2026-10-12T19:13:09Z; disclosure received September 30. GHSA-px85-f4q5-jh77: severity high; cve_id null; CVSS v4 8.7, vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (adjacent network, NO user interaction); CWE-22, 94, 306, 1188; identical version ranges and patched versions; reporters KimiSecurityTeam and christos-cantina-security; published 2026-10-12T19:13:08Z; disclosure received August 19. The article's scores, severity labels, GHSA IDs, no-CVE statement, version ranges, patched versions and both disclosure dates match. updated_at on re-fetch via the API: f2ph 2026-10-13T07:29:56Z, px85 2026-10-13T08:10:31Z, both before the submission timestamp (13:56Z), and the snapshot text matches the API description, so no change since the writer read them. source-2 (v9.1.21), source-3 (v10.6.2), source-4 (v11.0.0-alpha.6) were read: 10.6.2 (12 Oct 18:19) and 11.0.0-alpha.6 (12 Oct 16:46) each contain the verbatim entry 'Security: Patch GHSA-f2ph-cmg5-wxc8 and GHSA-px85-f4q5-jh77'; 9.1.21 (12 Oct 18:59) has no 'Security: Patch' line but lists 'Block iframe embedding of the dev server from non-localhost origins', 'Add host validation warning and origin validation for MCP', 'Contain save story path to the project root' (all quoted accurately, minus the 'Core:' prefix). The uncited 8.6.19 release was verified through the GitHub API (published 2026-10-12T19:06:45Z) and carries the same ten-item list as 9.1.21; the 8.x claim in the title is also supported by the advisory text itself ('including versions 8 and 9', 8.6.19 in the patched list). All five cited URLs are in the sources array and no other URL appears in the body.

Each direct quote was matched verbatim against the snapshot (e.g. 'A malicious website may be able to cause unauthorized file changes...', 'We are not aware of exploitation in the wild.', 'relies on correctly exploiting a sequence of many vulnerabilities, some of which were never disclosed to the Storybook team', 'not received evidence of exploitation in real Storybook projects', 'was too permissive and could be used to trigger arbitrary events', 'The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages'). The no-evidence-of-exploitation statements are attributed to the project. Default changes were checked per advisory: iframe embedding off by default, postMessage restricted to own origin and localhost, and the reworked highlight event (with the Chromatic Visual Tests 5.5.1 note) come from the critical advisory only; the 127.0.0.1 binding, the Vitest addon disabling browser.api.allowWrite/allowExec and stricter saveStoryRequest validation come from the high advisory only. Both advisories state the team changed defaults 'including versions 8 and 9' and both list all four release lines as affected and patched, so the title's 'Versions 8 Through 11 Alpha' is supported at the level of the vendor's blanket statement; the advisories do not itemise which default lands in which line, and the 10.6.2/11 alpha release notes only reference the GHSAs, so per-line application of each default rests on the vendor's generic statement (the 8.6.19 and 9.1.21 release notes do list the iframe, postMessage, highlight and Vitest changes; the loopback binding is not itemised in any release note). One factual defect: the closing section says 'The advisories describe a worst case that depends on user interaction and on a local runtime executing a changed file.' User interaction is a condition only of the critical advisory (CVSS UI:P, 'With user interaction'); the high advisory is rated UI:N and describes an attacker on the same local network, so the sentence generalises across the two advisories. Minor clarity issue: 'up to 8.6.19' (and 9.1.21, 10.6.2, 11.0.0-alpha.6) is shorthand for the advisories' exclusive '< x' ranges; the patched release itself is not affected.

Substantively accurate, well sourced and properly attributed; every identifier, score, vector, version range, patched version and date checked out against the snapshots and the GitHub API. One subordinate claim in the closing section is wrong for the high advisory and one phrase is ambiguous, both outside the headline, summary and lead, so APPROVE_WITH_CORRECTIONS with a two-entry corrections record. No allowlist change needed (github.com already listed).