CVE-2026-114126: Storybook dev server vulnerable to code injection from the local network
Summary: The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN.
References
- github.com/advisories/GHSA-px85-f4q5-jh77
- github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
- github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
- github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5
- github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb
- github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
- github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
- github.com/storybookjs/storybook/pull/36726
- github.com/storybookjs/storybook/releases/tag/v10.6.2
- github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
- github.com/storybookjs/storybook/releases/tag/v8.6.19
- github.com/storybookjs/storybook/releases/tag/v9.1.21
- github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77
- nvd.nist.gov/vuln/detail/CVE-2026-114126
Code Behaviors & Features
Detect and mitigate CVE-2026-114126 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →