CVE-2026-114125
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.
- No known exploitation
- Severity
- Critical, CVSS 9.4 (v4.0)
- EPSS
- 0.38% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- storybook (npm) >= 8.0.0, < 8.6.19, fixed in 8.6.19 · GHSA-f2ph-cmg5-wxc8
- storybook (npm) >= 9.0.0, < 9.1.21, fixed in 9.1.21 · GHSA-f2ph-cmg5-wxc8
- storybook (npm) >= 10.0.0, < 10.6.2, fixed in 10.6.2 · GHSA-f2ph-cmg5-wxc8
- storybook (npm) >= 11.0.0-alpha.0, < 11.0.0-alpha.6, fixed in 11.0.0-alpha.6 · GHSA-f2ph-cmg5-wxc8
- @storybook/core (npm) >= 8.0.0, < 8.6.19, fixed in 8.6.19 · GHSA-f2ph-cmg5-wxc8
- @storybook/core-server (npm) >= 8.0.0, < 8.6.19, fixed in 8.6.19 · GHSA-f2ph-cmg5-wxc8
- @storybook/experimental-addon-test (npm) >= 8.0.0, < 8.6.19, fixed in 8.6.19 · GHSA-f2ph-cmg5-wxc8
- @storybook/addon-vitest (npm) >= 9.0.0, < 9.1.21, fixed in 9.1.21 · GHSA-f2ph-cmg5-wxc8
- @storybook/addon-vitest (npm) >= 10.0.0, < 10.6.2, fixed in 10.6.2 · GHSA-f2ph-cmg5-wxc8
- @storybook/addon-vitest (npm) >= 11.0.0-alpha.0, < 11.0.0-alpha.6, fixed in 11.0.0-alpha.6 · GHSA-f2ph-cmg5-wxc8
- @storybook/addon-mcp (npm) >= 10.6.0, < 10.6.2, fixed in 10.6.2 · GHSA-f2ph-cmg5-wxc8
- @storybook/addon-mcp (npm) >= 11.0.0-alpha.0, < 11.0.0-alpha.6, fixed in 11.0.0-alpha.6 · GHSA-f2ph-cmg5-wxc8