Storybook: dev server exposes WebSocket auth token to LAN peers, enabling code injection and potential RCE on developer machines (CVE-2026-114126)
Severity: high · Patch status: patched · Since 2026-10-12 · CVE-2026-114126
A responsible disclosure on 2026-08-19 (published Oct 2026) showed the Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on the same LAN can open the app by IP, obtain the token, and use the WebSocket to inject code into story files or create new files; under certain conditions (notably with the Vitest addon and older Vitest) an attacker can execute code on the developer's machine. Anyone running storybook dev on an untrusted or spoofed local network is affected; serving built Storybook or binding to 127.0.0.1 is not. Patched releases (8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6) also change defaults: the dev server now binds only to 127.0.0.1, Vitest browser write/exec APIs are disabled, and saveStoryRequest input validation is stricter. No in-the-wild exploitation reported.
What to do
- Upgrade Storybook to a patched version (8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6+) before running storybook dev again
- Until upgraded, do not run the Storybook dev server on untrusted networks; bind to 127.0.0.1 or run in a container that doesn't publish the port
- If LAN sharing is needed, use --host with core.allowedHosts and firewall restrictions; prefer storybook build + static serving or Chromatic
- Audit whether any developer machines may have run affected dev servers on shared networks and review story files for unexpected changes
- If relying on Vitest browser.api.allowWrite/allowExec, review and consciously re-enable in Vitest config
Fixed versions
- storybook 8.6.19 / 9.1.21 / 10.6.2 / 11.0.0-alpha.6
- @storybook/core 8.6.19
- @storybook/core-server 8.6.19
- @storybook/experimental-addon-test 8.6.19
- @storybook/addon-vitest 9.1.21 / 10.6.2 / 11.0.0-alpha.6
- @storybook/addon-mcp 10.6.2 / 11.0.0-alpha.6
Sources
All live incidents on Threat Watch