cve.bz

CVE-2026-114125

8.6 highEPSS 0.4%

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

CVSS 4.0
8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-25)
CWEs
CWE-94, CWE-346, CWE-1021
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-f2ph-cmg5-wxc8npmstorybook>=8.0.0 <8.6.198.6.19
GHSA-f2ph-cmg5-wxc8npmstorybook>=9.0.0 <9.1.219.1.21
GHSA-f2ph-cmg5-wxc8npmstorybook>=10.0.0 <10.6.210.6.2
GHSA-f2ph-cmg5-wxc8npmstorybook>=11.0.0-alpha.0 <11.0.0-alpha.611.0.0-alpha.6
GHSA-f2ph-cmg5-wxc8npm@storybook/core>=8.0.0 <8.6.198.6.19
GHSA-f2ph-cmg5-wxc8npm@storybook/core-server>=8.0.0 <8.6.198.6.19
GHSA-f2ph-cmg5-wxc8npm@storybook/experimental-addon-test>=8.0.0 <8.6.198.6.19
GHSA-f2ph-cmg5-wxc8npm@storybook/addon-vitest>=9.0.0 <9.1.219.1.21
GHSA-f2ph-cmg5-wxc8npm@storybook/addon-vitest>=10.0.0 <10.6.210.6.2
GHSA-f2ph-cmg5-wxc8npm@storybook/addon-vitest>=11.0.0-alpha.0 <11.0.0-alpha.611.0.0-alpha.6
GHSA-f2ph-cmg5-wxc8npm@storybook/addon-mcp>=10.6.0 <10.6.210.6.2
GHSA-f2ph-cmg5-wxc8npm@storybook/addon-mcp>=11.0.0-alpha.0 <11.0.0-alpha.611.0.0-alpha.6

References

Check your stackJSON