Can local attackers hijack Storybook dev servers to run code?

The short version

• The National Vulnerability Database rates CVE-2026-114126 as high severity with a CVSS score of 8.7.
• The flaw allows local network attackers to access WebSocket authentication tokens exposed by the Storybook server.
• Successful exploitation can lead to remote code execution with the privileges of the developer.

The details

Storybook is a frontend workshop used for building user interface components in isolation. According to the NVD record, versions from 8.0.0 up to 8.6.19, as well as ranges in the 9.0, 10.0 and 11.0-alpha series, are vulnerable. The core issue involves the development server exposing its WebSocket authentication token to clients that can load its HTML pages over a local network.

An attacker on the same LAN can obtain this token and invoke WebSocket-backed functionality, including file-writing or testing features. Weak validation in story-write operations can allow code to be placed directly into story files. If the Storybook Vitest addon is installed with an older version of Vitest, the payload can use the Vitest API to write additional files or execute commands.

The context

This vulnerability combines path traversal weaknesses (CWE-22), code injection (CWE-94) and broken access control (CWE-306). The attack chain relies on the attacker being able to reach the development server over the local network. Depending on the payload and local tooling, the execution occurs with the developer's privileges. This suggests that local network segmentation and strict access controls are critical for protecting development environments.

Next steps

Patches have been released for the affected versions. Users should upgrade to 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6. Teams should verify their current Storybook version and apply the update immediately. Additionally, review any installed addons, particularly the Vitest addon, to ensure they are also up to date and compatible with the patched server version.

What defenders should look for

Teams usually monitor for unusual WebSocket connections originating from unexpected internal IP addresses. Check whether development servers are accessible from general network segments rather than restricted developer subnets. Look for anomalous file writes or test executions triggered via the Storybook interface. First containment moves typically involve isolating the affected development machine from the local network and rotating any exposed tokens or credentials.

What to do and how to stay safe: Storybook

• Audit your network to ensure Storybook development servers are not accessible from untrusted local subnets.
• Verify that all Storybook instances are updated to the patched versions listed in the advisory.
• Review logs for unauthorized WebSocket connections or unexpected file modifications in project directories.
• Ensure that the Vitest addon and other plugins are updated to versions compatible with the security fix.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Storybook are affected by CVE-2026-114126?

Versions 8.0.0 to 8.6.18, 9.0.0 to 9.1.20, 10.0.0 to 10.6.1, and 11.0.0-alpha.0 to 11.0.0-alpha.5 are affected.

How can an attacker exploit this vulnerability?

A local network attacker can steal the WebSocket token and use it to write files or execute commands via the server.

Is there a fix available for this issue?

Yes, patches are available in versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.