CVE-2026-114126: 
JavaScript vulnerability analysis and mitigation

CVE-2026-114126 is a code injection vulnerability in the Storybook frontend development server that allows an unauthenticated attacker on the same local area network (LAN) to achieve remote code execution with the developer's privileges. The vulnerability affects Storybook versions 8.0.0 through 8.6.18, 9.0.0 through 9.1.20, 10.0.0 through 10.6.1, and 11.0.0-alpha.0 through 11.0.0-alpha.5. It was responsibly disclosed to the Storybook team on August 19, 2026, and patched versions were published on October 12, 2026. The CVSS v3.1 base score is 8.8 (High) and the CVSS v4.0 base score is 8.7 (High) (GitHub Advisory, Red Hat CVE).

The vulnerability chains multiple weaknesses: the Storybook dev server embeds its WebSocket authentication token in HTML pages it serves (CWE-201 — Insertion of Sensitive Information Into Sent Data), and because the server historically bound to all network interfaces, any LAN host could load those pages and extract the token. With the token, an attacker can invoke WebSocket-backed functionality without further authentication (CWE-306 — Missing Authentication for Critical Function). Weak input validation in the saveStoryRequest event handler allows path traversal (CWE-22) and code injection (CWE-94) into story files. If the Storybook Vitest addon is installed with an older version of Vitest (prior to 3.2.7 or 4.1.0), the Vitest browser API's allowWrite and allowExec permissions default to true when the server is bound to loopback, enabling the injected payload to write arbitrary files or execute OS commands (GitHub Advisory, Patch PR #36726).

Successful exploitation can result in full remote code execution on the developer's workstation with the privileges of the user running the Storybook dev server, enabling arbitrary file writes, command execution, and potential lateral movement within the developer's environment. Confidentiality, integrity, and availability of the affected system are all rated High. The attack is particularly severe when the Storybook Vitest addon is installed with an unpatched Vitest version, as the attacker can leverage the Vitest browser API to write additional malicious files anywhere on the filesystem or spawn arbitrary processes (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting the current absence of observed exploitation activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires the attacker to be on the same LAN as the developer running the vulnerable Storybook dev server, and the worst-case scenario (RCE) additionally requires the Vitest addon with an old Vitest version to be installed (GitHub Advisory).

1. Reconnaissance: Scan the local network for hosts listening on the default Storybook port (TCP 6006) using tools like nmap -p 6006 192.168.x.0/24. Identify hosts serving Storybook HTML pages.
2. Token extraction: Load the Storybook HTML page from the target host (e.g., http://192.168.x.y:6006) and extract the WebSocket authentication token embedded in the page's JavaScript globals (e.g., CHANNEL_OPTIONS.wsToken).
3. WebSocket connection: Establish a WebSocket connection to the Storybook server channel endpoint: ws://192.168.x.y:6006/storybook-server-channel?token=<extracted_token>&page=manager.
4. Story file injection: Send a crafted saveStoryRequest WebSocket event with a malicious payload that exploits weak input validation to inject arbitrary code into a story file, potentially using path traversal to target a file that will be executed.
5. Vitest API abuse (if applicable): If the Storybook Vitest addon is installed with Vitest < 3.2.7 or < 4.1.0, trigger a test run via the WebSocket. The injected story payload can call Vitest browser API methods (allowWrite/allowExec defaulting to true) to write additional files or execute OS commands.
6. Code execution: Depending on the payload and local tooling (e.g., file watchers, auto-import, test runners), the injected code executes with the developer's OS privileges, enabling reverse shell, credential theft, or further persistence (GitHub Advisory, Patch PR #36726).

• Network: Unexpected WebSocket connections to port 6006 from non-localhost IP addresses; outbound connections from the developer workstation to unknown external hosts initiated by Node.js or child processes spawned by the Storybook server.
• Logs: Storybook dev server logs showing saveStoryRequest events originating from non-localhost clients; WebSocket upgrade requests from LAN IP addresses to /storybook-server-channel.
• File System: Unexpected new or modified .stories.js/.stories.ts files containing obfuscated or unusual code; new files written outside the project root directory; unexpected scripts or executables created in the project directory or system temp folders.
• Process: Unusual child processes spawned by the Node.js Storybook process (e.g., sh, bash, cmd.exe, curl, wget, python); unexpected network connections from Node.js to external IPs.

Upgrade Storybook to one of the patched versions: 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6. The patches change the default server binding from all interfaces to 127.0.0.1 only, strengthen saveStoryRequest input validation, and disable allowWrite/allowExec in the Vitest browser API by default. Additionally, upgrade Vite to 6.4.2, 7.3.2, or 8.0.5 (or later), and Vitest to 3.2.7 or 4.1.10 (or later). If an immediate upgrade is not possible, do not run the Storybook dev server on untrusted networks, and use a firewall to restrict access to port 6006 to trusted hosts only. Avoid using --host 0.0.0.0 without also configuring core.allowedHosts (GitHub Advisory, Patch PR #36726).

The Storybook team published a detailed security advisory (GHSA-px85-f4q5-jh77) crediting reporters from KimiSecurityTeam and christos-cantina-security for responsible disclosure, with remediation led by developer ghengeveld. The advisory notes that the team made deliberate breaking changes to default network behavior across all supported major versions (8, 9, 10, 11) due to the exceptional severity of the reported vulnerabilities. The patch also introduced migration guidance for teams relying on LAN-sharing or Vitest browser API features that were affected by the security hardening (GitHub Advisory).