CVE-2026-114126

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Storybook Development Server

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114126

EUVD

EUVD-2026-107408

Affected Vendors & Products

Vendor	Product	Version / Range
storybookjs	storybook	>= 8.0.0, < 8.6.19
storybookjs	storybook	>= 9.0.0, < 9.1.21
storybookjs	storybook	>= 10.0.0, < 10.6.2
storybookjs	storybook	>= 11.0.0-alpha.0, < 11.0.0-alpha.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects Storybook, a frontend UI component tool. From versions 8.0.0 to 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the development server exposed its WebSocket authentication token to clients on the same local network. An attacker on the LAN could obtain this token and use it to write malicious code into story files or execute commands via the WebSocket interface. Weak input validation allowed code injection into story files, and if the Vitest addon was outdated, the payload could use Vitest APIs to write files or run commands.

Detection Guidance

Check if Storybook dev server is binding to all network interfaces by running: netstat -tulnp | grep storybook or ss -tulnp | grep storybook. If it binds to 0.0.0.0, it may be exposed to LAN. Verify WebSocket token exposure by inspecting network traffic with tcpdump or Wireshark for unencrypted WebSocket connections on port 6006.

Impact Analysis

If you use an affected Storybook version on an untrusted network, an attacker on the same LAN could exploit this to inject malicious code into your project files. This could lead to arbitrary code execution on your machine with your privileges. The attack is possible even without direct access to your system, as long as the attacker is on the same local network.

Mitigation Strategies

Upgrade Storybook to patched versions: 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6.
Restart the dev server with --host 127.0.0.1 to bind only to localhost.
Disable Vitest addon or upgrade Vitest to a secure version.
Review and restrict network access to Storybook instances.

Hi! I’m here to help you understand CVE-2026-114126. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...