CVE-2026-114125
Description
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
How to fix
- storybook8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6 or later
- @storybook/core8.6.19 or later
- @storybook/core-server8.6.19 or later
- @storybook/experimental-addon-test8.6.19 or later
- @storybook/addon-vitest9.1.21, 10.6.2, 11.0.0-alpha.6 or later
- @storybook/addon-mcp10.6.2, 11.0.0-alpha.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| storybooknpm | 8.0.0 ≤ v < 8.6.19, 9.0.0 ≤ v < 9.1.21, 10.0.0 ≤ v < 10.6.2, 11.0.0-alpha.0 ≤ v < 11.0.0-alpha.6 | 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6 |
| @storybook/corenpm | 8.0.0 ≤ v < 8.6.19 | 8.6.19 |
| @storybook/core-servernpm | 8.0.0 ≤ v < 8.6.19 | 8.6.19 |
| @storybook/experimental-addon-testnpm | 8.0.0 ≤ v < 8.6.19 | 8.6.19 |
| @storybook/addon-vitestnpm | 9.0.0 ≤ v < 9.1.21, 10.0.0 ≤ v < 10.6.2, 11.0.0-alpha.0 ≤ v < 11.0.0-alpha.6 | 9.1.21, 10.6.2, 11.0.0-alpha.6 |
| @storybook/addon-mcpnpm | 10.6.0 ≤ v < 10.6.2, 11.0.0-alpha.0 ≤ v < 11.0.0-alpha.6 | 10.6.2, 11.0.0-alpha.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.