The vulnerability allows an attacker on a local network to retrieve the WebSocket authentication token that the Storybook development server provides to page clients. With this token, the attacker can write files through the server's file-writing API. Weak validation of story files can allow arbitrary code to be placed into story files. If the Vitest add-on is present and its version is outdated, the malicious payload can invoke Vitest APIs to create additional files or run commands, effectively enabling code execution under the privileges of the server’s user.

Storybook for JavaScript (storybookjs:storybook) from version 8.0.0 up to 8.6.19, 9.1.21, 10.6.2, and the 11.0.0-alpha.6 release. These versions are affected; newer releases beyond 11.0.0-alpha.6 address the issue.

The CVSS score of 8.7 classifies this flaw as high severity. The EPSS score of < 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. The attack vector requires an attacker to be on the same network segment as the development server: the attacker must HTTPGET the dev server’s HTML page to obtain the token, then open a WebSocket to perform the write operation. The lack of authentication (CWE-306) and improper path handling (CWE-22) permit the file-write operation, while the potential for code execution via the Vitest add-on introduces a higher impact (CWE-94).