{
  "schemaVersion": 1,
  "site": "https://cveboard.org",
  "generatedAt": "2026-10-23T20:16:46.481Z",
  "lastRun": "2026-10-23T20:01:03.754Z",
  "liveDays": 14,
  "filters": {
    "kind": null,
    "exploited": false,
    "severity": null,
    "ecosystems": [],
    "tag": "storybookjs"
  },
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incidents": [
    {
      "id": "cve-2026-114125",
      "url": "https://cveboard.org/i/cve-2026-114125",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-114125",
      "json": "https://cveboard.org/i/cve-2026-114125.json",
      "kind": "vuln",
      "live": true,
      "knownExploited": false,
      "severity": "critical",
      "title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites",
      "summary": "A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.",
      "titlePt": "Storybook: Falta de validação de origem no preview do Storybook permite a injeção de código de sites maliciosos",
      "summaryPt": "Um site malicioso pode ser capaz de causar alterações não autorizadas em arquivos de um projeto de um desenvolvedor enquanto um servidor de desenvolvimento Storybook afetado está em execução. Sob condições adicionais, um arquivo alterado pode ser executado por um tempo de execução local com os privilégios do desenvolvedor. Não temos conhecimento de exploração na natureza.",
      "affected": [],
      "omitted": 0,
      "references": [],
      "cwes": [
        {
          "id": "CWE-94",
          "name": "Improper Control of Generation of Code ('Code Injection')"
        },
        {
          "id": "CWE-346",
          "name": "Origin Validation Error"
        },
        {
          "id": "CWE-1021",
          "name": "Improper Restriction of Rendered UI Layers or Frames"
        }
      ],
      "ssvc": null,
      "fix": "listed",
      "tags": [
        "storybookjs",
        "npm"
      ],
      "cves": [
        "CVE-2026-114125"
      ],
      "ghsa": "GHSA-f2ph-cmg5-wxc8",
      "cvss": {
        "score": 9.4,
        "version": "4.0",
        "by": "GitHub"
      },
      "epss": {
        "percentage": 0.00375,
        "percentile": 0.30272,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [
        {
          "ecosystem": "npm",
          "name": "storybook",
          "vulnerable": ">= 8.0.0, < 8.6.19",
          "fixed": "8.6.19",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "storybook",
          "vulnerable": ">= 9.0.0, < 9.1.21",
          "fixed": "9.1.21",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "storybook",
          "vulnerable": ">= 10.0.0, < 10.6.2",
          "fixed": "10.6.2",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "storybook",
          "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6",
          "fixed": "11.0.0-alpha.6",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "@storybook/core",
          "vulnerable": ">= 8.0.0, < 8.6.19",
          "fixed": "8.6.19",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "@storybook/core-server",
          "vulnerable": ">= 8.0.0, < 8.6.19",
          "fixed": "8.6.19",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "@storybook/experimental-addon-test",
          "vulnerable": ">= 8.0.0, < 8.6.19",
          "fixed": "8.6.19",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "@storybook/addon-vitest",
          "vulnerable": ">= 9.0.0, < 9.1.21",
          "fixed": "9.1.21",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "@storybook/addon-vitest",
          "vulnerable": ">= 10.0.0, < 10.6.2",
          "fixed": "10.6.2",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "@storybook/addon-vitest",
          "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6",
          "fixed": "11.0.0-alpha.6",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "@storybook/addon-mcp",
          "vulnerable": ">= 10.6.0, < 10.6.2",
          "fixed": "10.6.2",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        },
        {
          "ecosystem": "npm",
          "name": "@storybook/addon-mcp",
          "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6",
          "fixed": "11.0.0-alpha.6",
          "advisory": "GHSA-f2ph-cmg5-wxc8"
        }
      ],
      "vendor": "storybookjs",
      "product": "storybook",
      "kev": null,
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "GitHub Advisory Database",
          "url": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8"
        }
      ],
      "cvePending": true,
      "publishedAt": "2026-10-21T17:23:29.000Z",
      "updatedAt": "2026-10-21T17:23:29.000Z"
    }
  ],
  "tag": {
    "tag": "storybookjs",
    "name": "storybookjs",
    "kev": null
  }
}