Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)
Storybook (dev server)
Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.
Why this severity: CVSS 4.0 8.6 (GitHub CNA, CVE record); Storybook's GitHub advisory GHSA-f2ph-cmg5-wxc8 rates it critical. Requires user interaction; no known exploitation.
- Started
- Oct 21, 2026
- Closed
- Oct 22, 2026
Affected
- storybook / @storybook/core / @storybook/core-server >= 8.0.0 < 8.6.19
- storybook >= 9.0.0 < 9.1.21
- storybook >= 10.0.0 < 10.6.2
- storybook >= 11.0.0-alpha.0 < 11.0.0-alpha.6
- @storybook/addon-vitest and @storybook/addon-mcp (matching ranges)
Fixed in
- 8.6.19
- 9.1.21
- 10.6.2
- 11.0.0-alpha.6
Timeline4
Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile.
SourceAdvisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again.
SourcePatched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour).
SourceStorybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server.
Source
Advisories4
Posts2
localhost isn't a security boundary, it's a port any tab can knock on... storybook dev servers v8 through 11 alpha, new mcp addon included, let a malicious website change files in your project while running. critical, GHSA-f2ph-cmg5-wxc8. upgrade before the next run
🚨 Si usas Storybook, actualiza antes de volver a correr el dev server: publicaron una vulnerabilidad crítica (CVSS v4 9.4), CVE-2026-114125. Afecta a Storybook 8, 9, 10 y 11 alpha. Corregidas: 8.6.19, 9.1.21, 10.6.2 y 11.0.0-alpha.6. Qué puede hacer un atacante 👇 t.co/fPN9ReSVRH
Notes & caveats
Affected/fixed versions and timeline from Storybook's own advisory and GitHub release dates. The CVE record's CNA score is CVSS 4.0 8.6 (HIGH) while the advisory label is critical and one tweet cites 9.4; pwn.watch uses the CVE record. Not in CISA KEV.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
