Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125) ยท updates https://pwn.watch/i/storybook-dev-server-cve-2026-114125 Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected. en Thu, 22 Oct 2026 00:00:00 GMT Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile. https://pwn.watch/i/storybook-dev-server-cve-2026-114125 https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-10-22-be729dd9 Thu, 22 Oct 2026 00:00:00 GMT high <p><a href="https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8">Source</a></p> Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again. https://pwn.watch/i/storybook-dev-server-cve-2026-114125 https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-10-21-77a17d54 Wed, 21 Oct 2026 00:00:00 GMT high <p><a href="https://github.com/advisories/GHSA-f2ph-cmg5-wxc8">Source</a></p> Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour). https://pwn.watch/i/storybook-dev-server-cve-2026-114125 https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-10-12-8803e9ae Mon, 12 Oct 2026 00:00:00 GMT high <p><a href="https://github.com/storybookjs/storybook/releases/tag/v10.6.2">Source</a></p> Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125): Storybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server. https://pwn.watch/i/storybook-dev-server-cve-2026-114125 https://pwn.watch/i/storybook-dev-server-cve-2026-114125#2026-09-30-37574a3c Wed, 30 Sep 2026 00:00:00 GMT high <p><a href="https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8">Source</a></p>