CVE-2026-114126: storybook >= 8.0.0, < 8.6.19, >= 9.0.0, < 9.1.21, >= 10.0.0, < 10.6.2, >= 11.0.0-alpha.0, < 11.0.0-alpha.6

Affected technology

storybook · >= 8.0.0, < 8.6.19, >= 9.0.0, < 9.1.21, >= 10.0.0, < 10.6.2, >= 11.0.0-alpha.0, < 11.0.0-alpha.6
storybookjs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.