Storybook dev server vulnerable to code injection from the local network
Published Oct 21, 2026 · Updated Oct 24, 2026 · Also known as GHSA-px85-f4q5-jh77
Original summary
Normalized public record · Updated Oct 24, 2026
Storybook dev server vulnerable to code injection from the local network
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- MEDIUM
- Confidence
- Not available
- Aliases
- GHSA-px85-f4q5-jh77
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- Security advisory ↗
- Source repository ↗
- Patch commit ↗
- Patch commit ↗
- Patch commit ↗
- Patch commit ↗
- Patch commit ↗
- Patch commit ↗
- Source repository ↗
- Source repository ↗
- Source repository ↗
- Source repository ↗
Record history
Published Oct 21, 2026 · Last refreshed Oct 24, 2026