CVE-2026-114125
CVE-2026-114125 updated by NVD
Summary
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| npm | @storybook/addon-mcp | — | 10.6.2, 11.0.0-alpha.6 |
| npm | @storybook/addon-vitest | — | 9.1.21, 10.6.2, 11.0.0-alpha.6 |
| npm | @storybook/core | — | 8.6.19 |
| npm | @storybook/core-server | — | 8.6.19 |
| npm | @storybook/experimental-addon-test | — | 8.6.19 |
| npm | storybook | — | 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6 |
Remediation: Upgrade to 10.6.2 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.
Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.
EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.