CVE-2026-114126 storybookjs CVE debrief

Who should care

Developers using Storybook, especially those connected to untrusted local networks or using the Vitest addon with an old version of Vitest, should verify their version and network exposure, and upgrade if necessary. This includes reviewing network configuration to prevent unauthorized access and ensuring that the dev server is not exposed to untrusted networks. Additionally, developers should review compensating controls for exposed systems while remedi [d

Why it matters

CVE-2026-114126 requires verification of Storybook version and network exposure to prevent code injection attacks from the local network.

• Code injection into story files
• Creation of new files on the developer's machine
• Potential execution of code on the machine of a developer connected to the same LAN
• Verification of affected versions and remediation steps required

Technical summary

The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages, allowing for code injection into story files or creation of new files under certain circumstances. This vulnerability can be exploited by any host on a LAN, potentially leading to code execution on the machine of a developer connected to the same LAN. The vulnerability is particularly concerning for developers using the Vitest addon with an old version of Vitest. Developers should verify their version and network exposure, and upgrade if necessary.

Defensive priority

Developers using Storybook should verify their version and network exposure, and upgrade if necessary.

Recommended defensive actions

• Verify Storybook version and check for exposure on untrusted networks
• Upgrade to a patched version of Storybook if necessary
• Review network configuration to prevent unauthorized access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The source corpus provides details on the vulnerability but does not specify all affected versions or exact remediation steps. The CVE record and source item provide information on the vulnerability, but additional verification is required to determine the full scope of affected versions and remediation steps. Official sources such as the CVE Program and NIST NVD provide relevant information, but may not have comprehensive details on all affected versions or specific fixes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.