Description
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Published: 2026-10-21
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-px85-f4q5-jh77 Storybook dev server vulnerable to code injection from the local network
History

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-201
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Thu, 22 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Storybookjs
Storybookjs storybook
Vendors & Products Storybookjs
Storybookjs storybook

Wed, 21 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Title Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files
Weaknesses CWE-22
CWE-306
CWE-94
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N'}

Subscriptions

Storybookjs Storybook
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-21T17:21:29.520Z

Reserved: 2026-10-20T21:53:58.472Z

Link: CVE-2026-114126

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T18:17:25.130

Modified: 2026-10-21T18:17:25.130

Link: CVE-2026-114126

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-21T17:21:29Z

Links: CVE-2026-114126 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:00:11Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data

  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')