CVE-2026-114125
Published:October 21, 2026
Updated:October 23, 2026
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Affected Packages
https://github.com/storybookjs/storybook.git (GITHUB):
Affected version(s) >=v11.0.0-alpha.0 <v11.0.0-alpha.6Fix Suggestion:
Update to version v11.0.0-alpha.6https://github.com/storybookjs/storybook.git (GITHUB):
Affected version(s) >=v8.0.0 <v8.6.19Fix Suggestion:
Update to version v8.6.19https://github.com/storybookjs/storybook.git (GITHUB):
Affected version(s) >=v9.0.0 <v9.1.21Fix Suggestion:
Update to version v9.1.21https://github.com/storybookjs/storybook.git (GITHUB):
Affected version(s) >=v10.0.0 <v10.6.2Fix Suggestion:
Update to version v10.6.2storybook (NPM):
Affected version(s) >=9.0.0 <9.1.21Fix Suggestion:
Update to version 9.1.21@storybook/addon-vitest (NPM):
Affected version(s) >=11.0.0-alpha.0 <11.0.0-alpha.6Fix Suggestion:
Update to version 11.0.0-alpha.6storybook (NPM):
Affected version(s) >=11.0.0-alpha.0 <11.0.0-alpha.6Fix Suggestion:
Update to version 11.0.0-alpha.6storybook (NPM):
Affected version(s) >=10.0.0 <10.6.2Fix Suggestion:
Update to version 10.6.2@storybook/addon-mcp (NPM):
Affected version(s) >=10.6.0 <10.6.2Fix Suggestion:
Update to version 10.6.2@storybook/experimental-addon-test (NPM):
Affected version(s) >=8.3.0-beta.2 <8.6.19Fix Suggestion:
Update to version 8.6.19@storybook/addon-mcp (NPM):
Affected version(s) >=11.0.0-alpha.0 <11.0.0-alpha.6Fix Suggestion:
Update to version 11.0.0-alpha.6@storybook/core (NPM):
Affected version(s) >=8.2.0-beta.0 <8.6.19Fix Suggestion:
Update to version 8.6.19@storybook/addon-vitest (NPM):
Affected version(s) >=10.0.0 <10.6.2Fix Suggestion:
Update to version 10.6.2@storybook/addon-vitest (NPM):
Affected version(s) >=9.0.0 <9.1.21Fix Suggestion:
Update to version 9.1.21Related Resources (13)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.6
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
ACTIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Restriction of Rendered UI Layers or Frames
Unintended Proxy or Intermediary ('Confused Deputy')
Exposed Dangerous Method or Function
Missing Authorization
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Origin Validation Error
Improper Control of Generation of Code ('Code Injection')
EPSS
Base Score:
0.38