Storybook server flaw risks remote code execution on local networks

Storybook has released patches for a high-severity vulnerability that allows attackers on the same local network to execute arbitrary code. The issue stems from an exposed WebSocket authentication token in the development server, which can be leveraged to write files or run commands with developer privileges.

What happened

The National Vulnerability Database records CVE-2026-114126 with a CVSS score of 8.7, classifying it as high severity. The weakness involves improper access control and code injection within the Storybook frontend workshop tool. Affected versions range from 8.0.0 through 8.6.18, 9.0.0 through 9.1.20, 10.0.0 through 10.6.1, and early alpha releases of version 11.

According to the NVD record, the development server exposes its WebSocket authentication token to clients that can load HTML pages over the local network. An attacker on the same LAN can capture this token and use it to invoke functionality backed by WebSocket connections. This includes file-writing capabilities and testing features that are normally restricted.

The vulnerability relies on weak validation of story-write operations, allowing code to be placed directly into story files. If the Storybook Vitest addon is installed alongside an older version of Vitest, the payload can exploit the Vitest API. This enables the attacker to write additional files or execute system commands, potentially achieving code execution with the privileges of the developer running the server.

Why it matters

This vulnerability poses a significant risk to development environments where Storybook servers are accessible over local networks. Attackers do not need to breach external firewalls; they only need network access to the machine running the development server. The ability to execute commands with developer privileges means an attacker could compromise source code, steal credentials, or pivot to other internal systems.

The combination of exposed tokens and weak validation creates a clear path from network access to code execution. Teams relying on older versions of Storybook for component development are particularly exposed if their machines are connected to shared Wi-Fi or office networks. The fixed versions address these weaknesses by securing the token exposure and improving validation logic.

What happens next

Organisations should immediately audit their development environments for affected Storybook versions. Update to the patched releases: 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6. Ensure that the Storybook Vitest addon is also updated if present. Monitor local network traffic for unusual WebSocket activity during the transition period to detect any ongoing exploitation attempts.

Patch priority

Security teams should prioritise updating Storybook instances that are accessible over local area networks or shared office Wi-Fi. Systems used by developers with high-level privileges require immediate attention, as a successful exploit grants access to those same credentials.

Before rolling out updates across all workstations, test the patched versions in a isolated environment to ensure compatibility with existing component libraries and build pipelines. Back up current project configurations to allow for quick rollback if integration issues arise. Reduce exposure by restricting network access to development servers until updates are applied, ensuring that only authorised machines can reach the local host.

Background: Remote code execution vulnerabilities

Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.

Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution

What to do and how to stay safe: Storybook

• Verify the installed Storybook version in all development projects and compare it against the affected ranges listed in the advisory.
• Update to the latest patched version as soon as possible, ensuring that related addons like Vitest are also current.
• Restrict network access to Storybook development servers to prevent unauthorised local network connections during the update process.
• Monitor server logs for suspicious WebSocket connections or file modifications that could indicate an active exploitation attempt.

Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality

General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Storybook versions are affected by CVE-2026-114126?

Versions from 8.0.0 up to 8.6.18, 9.0.0 up to 9.1.20, 10.0.0 up to 10.6.1, and 11.0.0-alpha.0 up to 11.0.0-alpha.5 are affected.

Is there a patch available for this vulnerability?

Yes, patches are available in versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

How can an attacker exploit this flaw?

An attacker on the same local network can obtain the exposed WebSocket token and use it to execute commands or write files via the development server.