fkie_cve-2026-114126

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

GHSA-px85-f4q5-jh77 — Storybook dev server vulnerable to code injection from the local network

Affected: npm: storybook, npm: @storybook/core, npm: @storybook/core-server, npm: @storybook/experimental-addon-test, npm: @storybook/addon-vitest, npm: @storybook/addon-mcp

**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN.

## Who is impacted?

You are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact of this advisory is more important if you have the Vitest addon installed and are using an old version of Vitest.

You are not impacted if:

- You run a dev server in an environment that other devices on your network cannot reach (e.g. a container that does not publish the Storybook port, or publishes it only on `127.0.0.1`) - You run a dev server whilst connected to a trusted local network - You serve a built version of Storybook on your machine

## Recommended actions

### Upgrade Storybook

Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur.

Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.

- 11.0.0-alpha.6 - 10.6.2 - 9.1.21 - 8.6…

Most recent entries from all

fkie_cve-2026-114126

GHSA-px85-f4q5-jh77 — Storybook dev server vulnerable to code injection from the local network