Security Flaw in Storybook Affecting Multiple Versions by StorybookJS
CVE-2026-114125
8.6HIGH
What is CVE-2026-114125?
A security vulnerability in Storybook allows malicious websites to interact with the preview of a running Storybook development server. This is due to insufficient iframe embedding and message-origin restrictions. If a developer visits a compromised site and engages with the injected interface, it could trigger unauthorized modifications to story files. If any modified file is executed by the local runtime, it can lead to arbitrary code execution under the developer's privileges. The issue has been addressed in the latest versions: 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Affected Version(s)
storybook >= 8.0.0, < 8.6.19 < 8.0.0, 8.6.19
storybook >= 9.0.0, < 9.1.21 < 9.0.0, 9.1.21
storybook >= 10.0.0, < 10.6.2 < 10.0.0, 10.6.2