{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-114125",
    "url": "https://cveboard.org/i/cve-2026-114125",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-114125",
    "json": "https://cveboard.org/i/cve-2026-114125.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites",
    "summary": "A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.",
    "titlePt": "Storybook: Falta de validação de origem no preview do Storybook permite a injeção de código de sites maliciosos",
    "summaryPt": "Um site malicioso pode ser capaz de causar alterações não autorizadas em arquivos de um projeto de um desenvolvedor enquanto um servidor de desenvolvimento Storybook afetado está em execução. Sob condições adicionais, um arquivo alterado pode ser executado por um tempo de execução local com os privilégios do desenvolvedor. Não temos conhecimento de exploração na natureza.",
    "cves": [
      "CVE-2026-114125"
    ],
    "ghsa": "GHSA-f2ph-cmg5-wxc8",
    "cvss": {
      "score": 9.4,
      "version": "4.0"
    },
    "epss": {
      "percentage": 0.00375,
      "percentile": 0.30254,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "npm",
        "name": "storybook",
        "vulnerable": ">= 8.0.0, < 8.6.19",
        "fixed": "8.6.19",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "storybook",
        "vulnerable": ">= 9.0.0, < 9.1.21",
        "fixed": "9.1.21",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "storybook",
        "vulnerable": ">= 10.0.0, < 10.6.2",
        "fixed": "10.6.2",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "storybook",
        "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6",
        "fixed": "11.0.0-alpha.6",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "@storybook/core",
        "vulnerable": ">= 8.0.0, < 8.6.19",
        "fixed": "8.6.19",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "@storybook/core-server",
        "vulnerable": ">= 8.0.0, < 8.6.19",
        "fixed": "8.6.19",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "@storybook/experimental-addon-test",
        "vulnerable": ">= 8.0.0, < 8.6.19",
        "fixed": "8.6.19",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "@storybook/addon-vitest",
        "vulnerable": ">= 9.0.0, < 9.1.21",
        "fixed": "9.1.21",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "@storybook/addon-vitest",
        "vulnerable": ">= 10.0.0, < 10.6.2",
        "fixed": "10.6.2",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "@storybook/addon-vitest",
        "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6",
        "fixed": "11.0.0-alpha.6",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "@storybook/addon-mcp",
        "vulnerable": ">= 10.6.0, < 10.6.2",
        "fixed": "10.6.2",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      },
      {
        "ecosystem": "npm",
        "name": "@storybook/addon-mcp",
        "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6",
        "fixed": "11.0.0-alpha.6",
        "advisory": "GHSA-f2ph-cmg5-wxc8"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8"
      }
    ],
    "publishedAt": "2026-10-21T17:23:29.000Z",
    "updatedAt": "2026-10-21T17:23:29.000Z"
  },
  "live": true,
  "events": [
    {
      "id": "ghsa:GHSA-f2ph-cmg5-wxc8:ghsa_published:2026-10-21T17:23:29.000Z",
      "incidentId": "cve-2026-114125",
      "type": "ghsa_published",
      "at": "2026-10-21T17:23:29.000Z",
      "detail": {
        "ghsa": "GHSA-f2ph-cmg5-wxc8",
        "severity": "critical",
        "fixed": "8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6"
      }
    }
  ]
}