# What changed in @storybook/blocks

> 2 changes in @storybook/blocks 8 from its official release notes, upgrade guides and advisories: 2 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@storybook/blocks/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @storybook/blocks 8

### Security

- Storybook dev server vulnerable to code injection from the local network (8.6.19) — [security advisory](https://github.com/advisories/GHSA-PX85-F4Q5-JH77)
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites (8.6.19) — [security advisory](https://github.com/advisories/GHSA-F2PH-CMG5-WXC8)