Storybook dev server: Token exposure on local network enables code injection
Summary
The Storybook development server (storybook dev) can expose its WebSocket authentication token to clients that can load its HTML pages over the local network. A attacker on the same LAN can use the token to call WebSocket-backed file-writing and testing functions and place code in story files. If the Vitest addon is installed with an old Vitest version, the payload can use Vitest APIs to write files or run commands, which can lead to code execution with the developer's privileges.
Affected
- Storybook 8.0.0 up to but excluding 8.6.19
- Storybook 9.0.0 up to but excluding 9.1.21
- Storybook 10.0.0 up to but excluding 10.6.2
- Storybook 11.0.0-alpha.0 up to but excluding 11.0.0-alpha.6
- Affected addons with their own version ranges: check all @storybook/* packages in lockfiles
Fixed in
- 8.6.19
- 9.1.21
- 10.6.2
- 11.0.0-alpha.6
Workaround
- Upgrading is the fix; no workaround is needed if you can upgrade.
- Do not run storybook dev on untrusted networks (public, guest, hotel or cafe Wi-Fi) until patched.
- Unknown whether the dev server binds only to 127.0.0.1 by default in fixed versions; verify in the release notes.
Exploitation
- Attack requires the attacker to be on the same local network as the developer.
- No privileges or user interaction required according to the CVSS vector.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept or in-the-wild exploitation known at the time of writing.
Our recommendation
- Upgrade all @storybook/* packages together to the fixed versions.
- Check lockfiles for old Vitest versions used with the Vitest addon and update them.
- Tell developers not to run the dev server on untrusted networks until they have upgraded.
- Only use fixed versions from the official Storybook releases, not unverified third-party rebuilds.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor security advisory GHSA-px85-f4q5-jh77 github.com
- OSV record CVE-2026-114126 osv.dev
- Release v8.6.19 github.com
- Release v9.1.21 github.com
- Release v10.6.2 github.com
- Release v11.0.0-alpha.6 github.com
- GitHub Advisory GHSA-px85-f4q5-jh77 github.com
- OpenCVE CVE-2026-114126 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:01.
Original description (NVD)
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
NVD references (12)
- https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
- https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
- https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5
- https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb
- https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
- https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
- https://github.com/storybookjs/storybook/pull/36726
- https://github.com/storybookjs/storybook/releases/tag/v10.6.2
- https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
- https://github.com/storybookjs/storybook/releases/tag/v8.6.19
- https://github.com/storybookjs/storybook/releases/tag/v9.1.21
- https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.