EUVD-2026-107408
GHSA-px85-f4q5-jh77
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain LAN access to dev server
-
DeliveryLoad Storybook HTML page
-
ExploitHarvest exposed WebSocket auth token
-
InstallInvoke WebSocket file-write API
-
C2Plant payload in story file
-
ExecuteAbuse old Vitest API
-
ImpactExecute code as developer
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the victim running the |
| Impact | This is a legitimate but conditionally-scoped risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scoring 8.7 High tells a consistent story with the description: the attack requires only adjacent-network (LAN) reach, no authentication, and no user interaction, because the dev server leaks its WebSocket auth token to any client that can load its HTML pages over the local network. The VC:H/VI:H/VA:H with SC:L/SI:L reflects that successful exploitation can reach code execution with the developer's privileges, with limited impact spilling to adjacent systems. Crucially, the full code-execution outcome is gated: it depends on the Storybook Vitest addon being installed AND an old Vitest version, plus 'local tooling' - so the worst-case impact is conditional, while the baseline file-write into story files is more broadly reachable. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AV:A (adjacent, not network) metric is the key risk-limiter: this is not internet-wide exploitable - an attacker must already share the victim's LAN and the dev server must be bound to a network-reachable interface (not just localhost). Net: real and worth patching promptly for frontend teams, especially on shared/untrusted networks, but materially lower real-world urgency than a remote-unauthenticated internet-facing RCE. |
| Exploit ScenarioDerived | A developer runs |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Storybook's storybook dev server hands its WebSocket authentication token to any client that can load its HTML pages, so an unauthenticated attacker sharing the developer's local network can open the dev server's HTML, steal the token, and drive WebSocket-backed file-writing and testing APIs. Weak validation of story-file writes lets the attacker plant code inside story files, and when the Storybook Vitest addon is paired with an outdated Vitest the payload can pivot through the Vitest API to write arbitrary files or execute commands with the developer's privileges. Affected are releases from 8.0.0 up to (but excluding) 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6; the vector is AV:A/PR:N, so no credentials are needed but the attacker must be on the same adjacent network - no public exploit code identified at time of analysis.
RemediationAI
Upgrade to a fixed release - 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6 - which is a vendor-released patch covering the token exposure, the loose story-write validation, the frame-ancestors CSP and the origin-restricted postMessage handling (release notes at https://github.com/storybookjs/storybook/releases/tag/v8.6.19, /v9.1.21, /v10.6.2 and /v11.0.0-alpha.6; fix commits include 243c06bf8f1e2f09446c44868ea100261e1374da, 3be03ec6f11f4616471cebc3fc65c13e1bf8c178 and 5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5). Until patched, the single most effective control is to stop binding the dev server to a LAN-reachable address: run storybook dev with --host 127.0.0.1 (or localhost) so the HTML and WebSocket are unreachable from adjacent hosts - the trade-off is that other devices and containers can no longer preview the running Storybook, in which case use storybook build and serve the static output instead. Also avoid running the dev server on shared, untrusted or public Wi-Fi/VPN segments, upgrade Vitest to a current release or remove the Storybook Vitest addon on developer machines (this forfeits the in-Storybook test runner but eliminates the RCE escalation path), and do not set security.insecureRemoteIframeEmbed or security.insecureIframeMessaging in .storybook/main - both re-open the embedding and messaging vectors and should only ever be enabled temporarily on a trusted, isolated network.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Storybook is a frontend workshop that developers run locally via the storybook dev command, which starts an HTTP server plus a WebSocket channel used by the manager UI and preview iframes to write story files, trigger test runs and reload content. The root cause class is CWE-22 (path traversal / improper limitation of a pathname to a restricted directory), realized here as insufficient validation of the paths Storybook accepts when writing story content over that channel: the server does not adequately constrain what can be written, and the authentication token that gates the WebSocket is embedded in the served HTML, which the dev server allows non-localhost origins to load and embed. Combined, a LAN peer can fetch the HTML, extract the token, and authenticate to the WebSocket API. Escalation depends on the Storybook Vitest addon being installed alongside an old Vitest version whose API accepts file-write and command execution requests, at which point the injected story payload yields arbitrary file write or command execution under the developer's account. The upstream fix (PR #36726) layers defenses: a Content-Security-Policy: frame-ancestors header on every dev-server response restricting embedding to Storybook itself and localhost/127.0.0.1, origin-restricted postMessage handling between manager and preview (messages are now addressed to the expected origin rather than *), stricter story-write validation, and new security.insecureRemoteIframeEmbed / security.insecureIframeMessaging opt-outs that restore the old permissive behavior. Note the two config escapes exist specifically so teams can re-enable the vulnerable embedding and messaging paths - turning them on reintroduces the exposure.
Know when Storybook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
LAN-only reach gives AV:A; token is leaked so PR:N and no victim action needed (UI:N); writing outside the app to the developer's host and tooling justifies S:C with high C/I/A.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Blast Radius
ecosystem impact- 9 npm packages depend on @storybook/core-server (6 direct, 3 indirect)
Ecosystem-wide dependent count for version 8.0.0.
Technical POC Analysis
The advisory tags four weaknesses: CWE-22 (path traversal, the primary mapping in the CVE record), CWE-94 (code injection), CWE-306 (missing auth for a critical function) and CWE-1188 (insecure defau…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Storybook's local development server (releases 8.0.0 through 8.6.18, 9.1.20, 10.6.1, and 11.0.0-alpha.5) leaks its WebSocket authentication token to anyone who can reach the dev server's web pages, allowing an attacker on the same network segment to write files and potentially execute commands with the developer's own privileges. Because the flaw is unauthenticated and lives on engineering workstations rather than production systems, leadership should treat it as a software supply-chain and source-code integrity risk: affected machines typically hold repository access, cloud credentials, and build secrets. No public exploit code has been identified, but no vendor patch is available yet, so exposure is limited only by where and how developers run the dev server.
No vendor-released patch identified at time of analysis. Interim mitigations: bind the dev server to 127.0.0.1 / localhost only, never run storybook dev on shared, public, or untrusted networks, block inbound access to dev-server ports at the host firewall, run dev servers inside containers or isolated VMs, disable the Storybook Vitest addon where unnecessary, update Vitest to a current release to break the documented pivot, monitor story files for unexpected changes, and rotate any credentials present on machines where the server was reachable beyond loopback.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Cross-site WebSocket hijacking leading to persistent XSS and Remote Code Execution affects Storybook's dev server prior
Cross-origin message injection in the Storybook preview iframe lets a malicious website drive a developer's locally runn
Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from `.env`
Exploit-DB