CVE-2026-114125
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.
- storybookjs storybook
- Critical
- CVSS 9.4
- EPSS 0.38%
- Fixed version listed
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| storybookjs storybook | >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6 | None listed |
Affected packages
| Package | Affected | Fixed in | Advisory |
|---|---|---|---|
| storybook (npm) | >= 8.0.0, < 8.6.19 | 8.6.19 | GHSA-f2ph-cmg5-wxc8 |
| storybook (npm) | >= 9.0.0, < 9.1.21 | 9.1.21 | GHSA-f2ph-cmg5-wxc8 |
| storybook (npm) | >= 10.0.0, < 10.6.2 | 10.6.2 | GHSA-f2ph-cmg5-wxc8 |
| storybook (npm) | >= 11.0.0-alpha.0, < 11.0.0-alpha.6 | 11.0.0-alpha.6 | GHSA-f2ph-cmg5-wxc8 |
| @storybook/core (npm) | >= 8.0.0, < 8.6.19 | 8.6.19 | GHSA-f2ph-cmg5-wxc8 |
| @storybook/core-server (npm) | >= 8.0.0, < 8.6.19 | 8.6.19 | GHSA-f2ph-cmg5-wxc8 |
| @storybook/experimental-addon-test (npm) | >= 8.0.0, < 8.6.19 | 8.6.19 | GHSA-f2ph-cmg5-wxc8 |
| @storybook/addon-vitest (npm) | >= 9.0.0, < 9.1.21 | 9.1.21 | GHSA-f2ph-cmg5-wxc8 |
| @storybook/addon-vitest (npm) | >= 10.0.0, < 10.6.2 | 10.6.2 | GHSA-f2ph-cmg5-wxc8 |
| @storybook/addon-vitest (npm) | >= 11.0.0-alpha.0, < 11.0.0-alpha.6 | 11.0.0-alpha.6 | GHSA-f2ph-cmg5-wxc8 |
| @storybook/addon-mcp (npm) | >= 10.6.0, < 10.6.2 | 10.6.2 | GHSA-f2ph-cmg5-wxc8 |
| @storybook/addon-mcp (npm) | >= 11.0.0-alpha.0, < 11.0.0-alpha.6 | 11.0.0-alpha.6 | GHSA-f2ph-cmg5-wxc8 |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.4 (v4.0, scored by GitHub)
- EPSS
- 0.38% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 24, 2026)
- Weakness
- CWE-94: Improper Control of Generation of Code ('Code Injection'); CWE-346: Origin Validation Error; CWE-1021: Improper Restriction of Rendered UI Layers or Frames
- Vendor
- storybookjs, storybook
Timeline
- GitHub published advisory GHSA-f2ph-cmg5-wxc8 (critical). Fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6.