CVE-2026-114126: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in storybookjs storybook

CVE-2026-114126 is a path traversal and authentication token exposure vulnerability in the Storybook development server affecting versions >=8.0.0 <8.6.19, >=9.0.0 <9.1.21, >=10.0.0 <10.6.2, and >=11.0.0-alpha.0 <11.0.0-alpha.6. The server exposes its WebSocket authentication token to clients on the local network, allowing an attacker to invoke WebSocket-backed file-writing or testing functions. Due to weak validation on story file writes, an attacker can inject code. When combined with an outdated Vitest addon, this can lead to arbitrary file writes or command execution with the developer's privileges. The vulnerability is addressed in the fixed versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

An attacker on the local network can obtain the WebSocket authentication token from the Storybook development server and exploit weak validation to write malicious code into story files. If the Vitest addon is present with an old Vitest version, this can escalate to arbitrary file writes or command execution with the privileges of the developer running Storybook. This can lead to compromise of the development environment and potentially further code execution.

Upgrade Storybook to version 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 or later where this vulnerability is fixed. Additionally, ensure the Vitest addon and Vitest itself are updated to secure versions. Avoid exposing the Storybook development server to untrusted local networks until patched.