WebSocket Vulnerability in Storybook Development Server Exposing Authentication Token
CVE-2026-114126
What is CVE-2026-114126?
The Storybook development server, versions 8.0.0 through 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, presents a significant vulnerability by exposing WebSocket authentication tokens to clients loading its HTML pages over a local network. This exposure can allow unauthorized LAN attackers to capture the token and misuse WebSocket-backed functionalities, such as file-writing or testing capabilities. Additionally, weak validation processes related to story-writing can facilitate the inclusion of malicious code in story files. If an outdated version of the Vitest API is paired with the Storybook Vitest addon, there exists a possibility for the payload to execute commands or create additional files, thereby exploiting the developer's privileges. Immediate updates are available in the aforementioned fixed versions.
Affected Version(s)
storybook >= 8.0.0, < 8.6.19 < 8.0.0, 8.6.19
storybook >= 9.0.0, < 9.1.21 < 9.0.0, 9.1.21
storybook >= 10.0.0, < 10.6.2 < 10.0.0, 10.6.2