{"id":"EUVD-2026-107408","enisaUuid":"b8066ccc-f111-36f4-8b7c-6d942fba0021","description":"Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer\u0027s privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.","datePublished":"Oct 21, 2026, 5:21:29 PM","dateUpdated":"Oct 28, 2026, 1:28:25 AM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N","references":"https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77\nhttps://github.com/storybookjs/storybook/pull/36726\nhttps://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da\nhttps://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178\nhttps://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5\nhttps://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb\nhttps://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e\nhttps://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed\nhttps://github.com/storybookjs/storybook/releases/tag/v10.6.2\nhttps://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6\nhttps://github.com/storybookjs/storybook/releases/tag/v8.6.19\nhttps://github.com/storybookjs/storybook/releases/tag/v9.1.21\n","aliases":"CVE-2026-114126\nGHSA-px85-f4q5-jh77\n","assigner":"GitHub_M","epss":0.53,"enisaIdProduct":[{"id":"0cdc71e0-9366-3b81-b5a3-54e22b1bf88d","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"11.0.0-alpha.0, \u003c 11.0.0-alpha.6"},{"id":"17deba6c-e8ba-332a-870d-945fa36002c6","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"10.0.0, \u003c 10.6.2"},{"id":"62d63b91-51c4-3e3e-b78e-97409580dcab","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"9.0.0, \u003c 9.1.21"},{"id":"9be2b972-187d-3811-a96b-ff1338de0d9c","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"8.0.0, \u003c 8.6.19"}],"enisaIdVendor":[{"id":"ccf7b88e-13b1-364f-b6ec-1ef48062f01b","vendor":{"name":"storybookjs"}}],"enisaIdVulnerability":[{"id":"81a14102-9be1-32f7-a143-ed71a0533820","vulnerability":{"id":"GHSA-px85-f4q5-jh77","description":"Storybook dev server vulnerable to code injection from the local network","datePublished":"Oct 22, 2026, 4:31:40 PM","dateUpdated":"Oct 22, 2026, 4:31:40 PM","baseScore":0.0,"references":"https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114126\nhttps://github.com/storybookjs/storybook/pull/36726\nhttps://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da\nhttps://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178\nhttps://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5\nhttps://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb\nhttps://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e\nhttps://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed\nhttps://github.com/storybookjs/storybook\nhttps://github.com/storybookjs/storybook/releases/tag/v10.6.2\nhttps://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6\nhttps://github.com/storybookjs/storybook/releases/tag/v8.6.19\nhttps://github.com/storybookjs/storybook/releases/tag/v9.1.21\n","enisa_id":"EUVD-2026-107408\n","aliases":"CVE-2026-114126\nGHSA-px85-f4q5-jh77\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"eb6505fc-a67c-3de3-a35d-75affa84e714","vulnerability":{"id":"CVE-2026-114126","description":"Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files. If the Storybook Vitest addon is installed with an old version of Vitest, the payload can use a Vitest API to write additional files or execute commands. Depending on the payload and local tooling, the attack can lead to code execution with the developer\u0027s privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.","datePublished":"Oct 21, 2026, 5:21:29 PM","dateUpdated":"Oct 28, 2026, 1:28:25 AM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N","references":"https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77\nhttps://github.com/storybookjs/storybook/pull/36726\nhttps://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da\nhttps://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178\nhttps://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5\nhttps://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb\nhttps://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e\nhttps://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed\nhttps://github.com/storybookjs/storybook/releases/tag/v10.6.2\nhttps://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6\nhttps://github.com/storybookjs/storybook/releases/tag/v8.6.19\nhttps://github.com/storybookjs/storybook/releases/tag/v9.1.21\n","enisa_id":"EUVD-2026-107408\n","assigner":"GitHub_M","epss":0.53,"dataProcessed":"Oct 30, 2026, 3:01:44 AM","vulnerabilityProduct":[{"id":"29646d4f-8166-396e-b3b8-5b17101fb51e","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"11.0.0-alpha.0, \u003c 11.0.0-alpha.6"},{"id":"6c7eb26c-a78d-3005-b8a5-f1e8fcfb5f6a","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"9.0.0, \u003c 9.1.21"},{"id":"8ed06bcb-88b3-38f1-929e-f2969b079d86","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"8.0.0, \u003c 8.6.19"},{"id":"f4e3ec6f-78bc-30b8-98d6-e220e9c2bcb0","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"10.0.0, \u003c 10.6.2"}],"vulnerabilityVendor":[{"id":"9dd51d65-54ee-3a4b-be34-fd89f9b028e0","vendor":{"name":"storybookjs"}}]}}],"enisaIdAdvisory":[{"id":"6a99fdaa-913a-30e2-83ed-b42d6e1a8fd1","advisory":{"id":"RHSA-2026:88478","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 23, 2026, 1:10:24 AM","dateUpdated":"Oct 23, 2026, 5:39:12 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88478\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88478.json\n","aliases":"CVE-2026-111755\nCVE-2026-111756\nCVE-2026-114125\nCVE-2026-114126\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"00b01034-98f9-3910-b49c-3b5736179aae","product":{"name":"grafana12.4-0:12.4.13-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"471e265c-9e89-3e31-85cd-919f8641339a","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"8b484f90-8a4e-3a2c-bcca-81ea341db71f","product":{"name":"grafana12.4-0:12.4.13-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"d98f79ac-2aea-31c6-aa4f-5e19eefb45fa","product":{"name":"grafana12.4-0:12.4.13-0.3.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"ccc32485-67c5-30cb-924b-66d047e4cc26","advisory":{"id":"RHSA-2026:88537","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 23, 2026, 2:44:52 AM","dateUpdated":"Oct 23, 2026, 5:39:12 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88537\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88537.json\n","aliases":"CVE-2026-111755\nCVE-2026-111756\nCVE-2026-114125\nCVE-2026-114126\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"808e1ae6-5952-3079-91e5-6e5e55907a8f","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"b0ac5b27-79e5-3098-bc9c-60a32f88ef3c","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"e2e46c28-81e5-3771-8615-39f32be989d2","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"e354f31d-4406-3112-8c80-7f6ebc8b6eb4","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"ee6c0769-6bbd-36a3-a31e-d4cf7d0068b6","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"e8369684-cdbb-3932-beee-291964f6ade9","advisory":{"id":"RHSA-2026:88541","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 23, 2026, 2:59:13 AM","dateUpdated":"Oct 23, 2026, 5:39:18 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88541\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88541.json\n","aliases":"CVE-2026-40895\nCVE-2026-111755\nCVE-2026-111756\nCVE-2026-114125\nCVE-2026-114126\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"12647ded-34be-3382-b4ea-96d80bc46606","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"1ba9a7b6-b93a-3827-8562-69c159281910","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"9a9b4d44-debf-39c6-afbd-db49c32117f1","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"a11f28bb-db66-3823-b996-24cea33e0f4e","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"a70351d2-2ed1-3591-a782-fce4c7f8bf32","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}}]}}]}