Storybook: Remote code execution via local network WebSocket token theft (CVE-2026-114126)

Storybook development servers are vulnerable to remote code execution (CVE-2026-114126) when accessible from an untrusted local network. An attacker can access the Storybook dev server by IP address, bypass WebSocket authentication, and interact with the server's WebSocket API. This access permits the injection of malicious code into story files or the triggering of file operations through the Vitest addon. The vulnerability is mitigated by upgrading to patched versions, which enforce stricter host binding (loopback only) and restrict dangerous filesystem/process execution APIs within the Vitest addon.

Attack Chain

1. Attacker connects to the same local network (LAN/WiFi) as a developer running a Storybook dev server.
2. Attacker probes the local network to locate active Storybook dev server instances.
3. Attacker accesses the Storybook web UI via browser or client request, causing the browser to load the vulnerable page.
4. Attacker extracts the WebSocket authentication token exposed by the vulnerable server.
5. Attacker authenticates to the WebSocket API using the stolen token.
6. Attacker sends a malicious request to the saveStoryRequest event to write a payload into a story file.
7. Attacker triggers a test execution cycle via the WebSocket.
8. If the Vitest addon is installed, the injected payload leverages the addon API to write arbitrary files or execute processes on the developer machine.

Impact

The vulnerability allows unauthorized parties to perform arbitrary file writes and execute code on developer workstations. The impact is elevated if the Vitest addon is present and configured with unrestricted filesystem or execution permissions.

Recommendation

• Upgrade Storybook packages immediately: 11.0.0-alpha.6, 10.6.2, 9.1.21, or 8.6.19.
• Audit existing environments and ensure development servers bind only to '127.0.0.1' unless explicitly required for shared network testing.
• Restrict access to development machines using local host-based firewalls to prevent unauthorized ingress from untrusted network peers.
• Review and disable 'browser.api.allowWrite' and 'browser.api.allowExec' in Vitest configurations if these capabilities are not required for development workflows.
• Avoid using the '--host' CLI option with insecure interfaces (e.g., '0.0.0.0') on untrusted local networks.