CVE-2026-114125 · GHSA-f2ph-cmg5-wxc8

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Risk score: 68/100
CVSS: 8.6 v4.0
Exploit chance (30 days): 0.4%
Published: 21 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Storybook has a vulnerability in its preview feature, allowing malicious websites to inject code and potentially execute arbitrary code with the developer's privileges. An attacker can cause unauthorized changes to story files and execute arbitrary code if a changed file is later executed by a local runtime.
Affected: {'products': ['Storybook'], 'packages': ['storybook', '@storybook/core', '@storybook/core-server', '@storybook/experimental-addon-test', '@storybook/addon-vitest'], 'versions': ['>= 8.0.0, < 8.6.19', '>= 9.0.0, < 9.1.21', '>= 10.0.0, < 10.6.2', '>= 11.0.0-alpha.0, < 11.0.0-alpha.6']}
Fix: Upgrade to version 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

storybook: Amber, patch this week. Storybook has a vulnerability in its preview feature, allowing malicious websites to inject code and potentially execute arbitrary code with the developer's privileges. An attacker can cause unauthorized changes to story files and execute arbitrary code if a changed file is later executed by a local runtime.

The flaws

CVE-2026-114125: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites (CVSS 8.6 · EPSS 0%)
CVE-2026-114126: Storybook dev server vulnerable to code injection from the local network (CVSS 8.7 · EPSS 0%)

The fix

Upgrade storybook: 8.6.19 · 9.1.21 · 10.6.2 · 11.0.0 or later on your release line

Who is exposed: {'products': ['Storybook'], 'packages': ['storybook', '@storybook/core', '@storybook/core-server', '@storybook/experimental-addon-test', '@storybook/addon-vitest'], 'versions': ['>= 8.0.0, < 8.6.19', '>= 9.0.0, < 9.1.21', '>= 10.0.0, < 10.6.2', '>= 11.0.0-alpha.0, < 11.0.0-alpha.6']}

Where it stands

No known exploitation

Connects to

Same weakness: Path traversal (CWE-22). 398 other warnings in 30 days

Why it is Amber

CVSS 8.6 high
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
storybook	npm	>= 8.0.0, < 8.6.19	8.6.19
storybook	npm	>= 9.0.0, < 9.1.21	9.1.21
storybook	npm	>= 10.0.0, < 10.6.2	10.6.2
storybook	npm	>= 11.0.0-alpha.0, < 11.0.0-alpha.6	11.0.0-alpha.6
@storybook/core	npm	>= 8.0.0, < 8.6.19	8.6.19
@storybook/core-server	npm	>= 8.0.0, < 8.6.19	8.6.19
@storybook/experimental-addon-test	npm	>= 8.0.0, < 8.6.19	8.6.19
@storybook/addon-vitest	npm	>= 9.0.0, < 9.1.21	9.1.21
@storybook/addon-vitest	npm	>= 10.0.0, < 10.6.2	10.6.2
@storybook/addon-vitest	npm	>= 11.0.0-alpha.0, < 11.0.0-alpha.6	11.0.0-alpha.6
@storybook/addon-mcp	npm	>= 10.6.0, < 10.6.2	10.6.2
@storybook/addon-mcp	npm	>= 11.0.0-alpha.0, < 11.0.0-alpha.6	11.0.0-alpha.6

References

Original description

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

Last activity 21 Oct 2026. Patch Forecast updates every hour.