Summary
Someone on the same local network who can reach a Storybook development server can obtain its WebSocket token and inject code into story files. With the Vitest addon, the attack can write additional files and may lead to code execution depending on the setup. Published static builds and development servers that other network devices cannot reach are not affected. Affected Storybook release lines are 8.x, 9.x, 10.x, and 11 alpha before their respective fixes: 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Technical analysis
The accompanying research article explains the finding, reproduction, and remediation status.
Read the technical write-upDisclosure timeline
- Public disclosure
Credits
Reported by KimiSecurityTeam and christos-cantina-security; remediation by Sidnioulz and coordination by ghengeveld, as credited in Storybook's advisory.