CVE-2026-114126

None

CVSS

—

EPSS

0.5%

Published

Oct 21, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A local-network attacker could trick a developer's computer into running malicious code by stealing a secret token that Storybook uses to talk to itself.

Exploitation: Adjacent Network
Attacker needs: None
Complexity: Low
Impact: Remote Code Execution
Component: Application
Class: Path Traversal
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

The Storybook dev server exposes its WebSocket authentication token to any client on the local network that can load its HTML pages, allowing unauthenticated LAN attackers to invoke file-writing and testing APIs; weak story-write validation combined with an outdated Vitest addon permits arbitrary file writes and command execution under the developer's privileges.

Why it matters to the business

Local network attackers can achieve code execution on developer workstations running affected Grafana builds, risking source-code tampering, supply-chain compromise, and lateral movement; the flaw affects multiple Red Hat Grafana streams released only five days ago with modest but rising exploit probability.

How an attack unfolds

An attacker on the same LAN loads a Storybook HTML page to harvest the WebSocket token, connects to the server, writes a malicious story file, and—if the Vitest addon is present—leverages the Vitest API to drop additional payloads or run commands, resulting in developer-privilege code execution.

How to fix it

Upgrade Grafana to the fixed releases 12.4.13-0.3.hum1, 13.1.8-0.4.hum1, or 13.2.4-0.3.hum1 (RHSA-2026:88541) on Red Hat systems; disable the Storybook dev server or restrict it to localhost when upgrades are not immediately possible.

How to confirm the fix worked

Confirm Storybook version is at or above 8.6.19 / 9.1.21 / 10.6.2 / 11.0.0-alpha.6; verify Grafana packages match the listed fixed versions; scan developer workstations for unexpected story files or Vitest-related processes after patching.

Typical attack path

Discover Storybook dev server on local network via HTML page load
Extract WebSocket authentication token from client-side resources
Authenticate to WebSocket and invoke file-write or test APIs
Bypass weak story-write validation to place attacker-controlled code
Trigger Vitest addon (if present) to write files or execute commands

How to detect it

Review web-server and Storybook logs for unexpected WebSocket handshakes from non-localhost origins; inspect filesystem timestamps on story files and Vitest-related directories for recent unauthorized writes; correlate with developer workstation process execution of node or vitest binaries.

What your security team should do

Apply the listed Grafana package updates within the next 48 hours given the five-day publication window
Inventory all developer environments for Storybook or Grafana instances using the Vitest addon
Restrict Storybook dev servers to localhost-only binding until patches are deployed
Monitor LAN traffic for unexpected WebSocket connections to developer workstations

The record

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

Affected packages

Ecosystem	Package	Introduced	Fixed