Developer platforms, tools and supply chain

Storybook: CVE-2026-114126 dev server code injection from the local network

Storybook check

The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on the same network can open the Storybook by IP address, obtain the token, and call the WebSocket-backed file-writing and testing features. Weak validation of the "write story" feature lets that code land in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use Vitest's API to write more files or run commands, which can end in code execution with the developer's privileges.

Quick start

1. Download the script. The repository is mirrored on GitHub and Codeberg; pick a base URL.

   # BASE from GitHub:   https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main
   # BASE from Codeberg: https://codeberg.org/PrivacySafe/security-patches/raw/branch/main
   # curl -fLO "$BASE/storybook/storybook-check.sh"
   curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/storybook/storybook-check.sh
   

2. Read it before running it, then make it executable.

   less storybook-check.sh
   chmod +x storybook-check.sh
   

3. Check this machine. By default it searches /var/www /srv /opt /home. Pass directories to narrow it. Run it while your dev server is running if you want it to see the listening address.

   ./storybook-check.sh check
   ./storybook-check.sh check ~/projects/ui
   

Commands

Exit codes: 0 nothing exposed, 1 an affected version while a dev server is listening beyond loopback or is started with a non-loopback --host, 2 bad arguments.

How to read the result

• Affected version and a dev server listening beyond loopback right now: exposed. Stop it, upgrade, and treat any story file you did not write as suspect (this flaw writes code into story files; review recent changes in version control).
• Affected version, no dev server running: exit 0 with a warning to update before the next run, because the next storybook dev will listen on all interfaces.
• A script with --host 0.0.0.0 or another non-loopback address: exposed by configuration. --host 127.0.0.1 or localhost is not flagged.
• Fixed version: fine even while a dev server listens on 0.0.0.0. The check is on the version, not on the socket.
• Storybook 7.x and earlier are outside the advisory's range but unsupported: update anyway.
• Look-alikes (eslint-plugin-storybook, @storybook/*) are different packages and are not matched, in all four lock formats.
• Prereleases: 11.0.0-alpha.0 to alpha.5 are affected; alpha.6 and later are fixed.

Fixing it

Upgrade to 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6 or newer. If you cannot, do not run an affected dev server, or run it only on a network you fully trust.

Sources

• Advisory GHSA-px85-f4q5-jh77
• GitLab advisory database entry for CVE-2026-114126

Before you run it

• The fix. Update to 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6. The fixed releases also bind the dev server to 127.0.0.1 by default. If you cannot upgrade, do not run an affected dev server (the vendor's advice).
• Running storybook dev is the exposure. Affected versions listen on all network interfaces, so a host on the same network can obtain the WebSocket token. A Storybook built and served as static files has no dev server and is not reachable this way.
• Code execution depends on the Vitest addon. With the Storybook Vitest addon and an old Vitest, the payload can write more files or run commands as the developer.
• There is no hunt. No indicators of exploitation have been published.
• It also checks running docker and podman containers, unless you name a directory or set SCAN_CONTAINERS=0. In each running container, a read-only probe lists the project files this check needs: lockfiles, package.json, route directory names, the few source files that contain 'use server', config/auth.php and similar. Only those files are copied into a private temporary folder, and the normal check judges that folder like a host directory. The version comes from the copied lockfile or the installed node_modules/storybook/package.json, and the package.json scripts are read for an explicit non-loopback --host. A dev server that is listening right now is probed on the host only. A staged symlink is never kept, paths the container reports are validated, and nothing is run in a container beyond find, grep and test. The copies are removed on exit. A path shown as .../docker_NAME/PATH is the PATH inside the container NAME. It is skipped when you name directories yourself.

Red Hat advisories

Red Hat's advisory list (security advisories released 2026-04-01 to 2026-11-03) names the CVEs below. A Red Hat build is judged by its RPM release, not by the upstream version number, because Red Hat backports fixes: the advisory names the release that fixes it. A CVE with no advisory in the list has none for that period, which is not the same as not affected. The current state is on Red Hat's CVE database.

Red Hat's advisories for this CVE are for Grafana, not for a package called Storybook.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg