# Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125) · pwn.watch > Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected. Page: https://pwn.watch/i/storybook-dev-server-cve-2026-114125 · generated 2026-10-22T23:52:53.443Z ## Status - Severity: high · status: closed · patch: patched - Product: Storybook (dev server) - Started: 2026-10-21 · closed: 2026-10-22 - CVEs: CVE-2026-114125 - Affected: storybook / @storybook/core / @storybook/core-server >= 8.0.0 < 8.6.19; storybook >= 9.0.0 < 9.1.21; storybook >= 10.0.0 < 10.6.2; storybook >= 11.0.0-alpha.0 < 11.0.0-alpha.6; @storybook/addon-vitest and @storybook/addon-mcp (matching ranges) - Fixed in: 8.6.19; 9.1.21; 10.6.2; 11.0.0-alpha.6 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/storybook-dev-server-cve-2026-114125/feed.xml - JSON Feed: https://pwn.watch/i/storybook-dev-server-cve-2026-114125/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/storybook-dev-server-cve-2026-114125.json - This file: https://pwn.watch/i/storybook-dev-server-cve-2026-114125/llms.txt ## Updates (newest first) - 2026-10-22: Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile. (https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8) - 2026-10-21: Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again. (https://github.com/advisories/GHSA-f2ph-cmg5-wxc8) - 2026-10-12: Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour). (https://github.com/storybookjs/storybook/releases/tag/v10.6.2) - 2026-09-30: Storybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server. (https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8) ## Fix brief # Security brief: Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125) Source: https://pwn.watch/i/storybook-dev-server-cve-2026-114125 · status: closed (closed Oct 22, 2026) · severity: high · updated Oct 22, 2026, 12:43 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected. Severity detail: CVSS 4.0 8.6 (GitHub CNA, CVE record); Storybook's GitHub advisory GHSA-f2ph-cmg5-wxc8 rates it critical. Requires user interaction; no known exploitation. - Product: Storybook (dev server) - CVE / advisory ids: CVE-2026-114125 ## Affected versions - storybook / @storybook/core / @storybook/core-server >= 8.0.0 < 8.6.19 - storybook >= 9.0.0 < 9.1.21 - storybook >= 10.0.0 < 10.6.2 - storybook >= 11.0.0-alpha.0 < 11.0.0-alpha.6 - @storybook/addon-vitest and @storybook/addon-mcp (matching ranges) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 8.6.19 - 9.1.21 - 10.6.2 - 11.0.0-alpha.6 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes - Check `storybook` (and `@storybook/core`, `@storybook/core-server`, `@storybook/addon-vitest`, `@storybook/addon-mcp`, `@storybook/experimental-addon-test`) in the lockfile. - Upgrade to 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6 (same major) or later. - If Chromatic Visual Tests addon is used, upgrade it to 5.5.1+. - Built/static Storybooks are not affected; only `storybook dev` opened in a browser. - Do not enable `security.insecureRemoteIframeEmbed` or `security.insecureIframeMessaging` unless strictly needed. ## Latest updates - Oct 22, 2026: Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile. - Oct 21, 2026: Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again. - Oct 12, 2026: Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour). - Sep 30, 2026: Storybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server. ## Advisories - [Missing origin validation in Storybook preview allows code injection from malicious websites (GHSA-f2ph-cmg5-wxc8)](https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8) (Storybook) - [CVE-2026-114125](https://www.cve.org/CVERecord?id=CVE-2026-114125) (MITRE) - [GitHub Advisory Database: GHSA-f2ph-cmg5-wxc8](https://github.com/advisories/GHSA-f2ph-cmg5-wxc8) (GitHub) - [Storybook v10.6.2 release](https://github.com/storybookjs/storybook/releases/tag/v10.6.2) (Storybook) ## Caveats Affected/fixed versions and timeline from Storybook's own advisory and GitHub release dates. The CVE record's CNA score is CVSS 4.0 8.6 (HIGH) while the advisory label is critical and one tweet cites 9.4; pwn.watch uses the CVE record. Not in CISA KEV. --- Machine-readable: https://pwn.watch/i/storybook-dev-server-cve-2026-114125.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.