{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125) · updates",
  "home_page_url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125",
  "feed_url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125/feed.json",
  "description": "Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.",
  "language": "en",
  "_pwn": {
    "slug": "storybook-dev-server-cve-2026-114125",
    "severity": "high",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125/feed.xml",
    "llms": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125/llms.txt",
    "json": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-10-22-be729dd9",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-10-22-be729dd9",
      "title": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile.",
      "content_text": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile.\n\nSource: https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "date_published": "2026-10-22T00:00:00.000Z",
      "external_url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-10-21-77a17d54",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-10-21-77a17d54",
      "title": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again.",
      "content_text": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again.\n\nSource: https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
      "date_published": "2026-10-21T00:00:00.000Z",
      "external_url": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-10-12-8803e9ae",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-10-12-8803e9ae",
      "title": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour).",
      "content_text": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour).\n\nSource: https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
      "date_published": "2026-10-12T00:00:00.000Z",
      "external_url": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-09-30-37574a3c",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-09-30-37574a3c",
      "title": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Storybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server.",
      "content_text": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Storybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server.\n\nSource: https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "date_published": "2026-09-30T00:00:00.000Z",
      "external_url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "tags": [
        "high"
      ]
    }
  ]
}