Security incidents tagged Storybook. Newest first.
Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.
Storybook (dev server)Closed Oct 22, 2026
🚨 Si usas Storybook, actualiza antes de volver a correr el dev server: publicaron una vulnerabilidad crítica (CVSS v4 9.4), CVE-2026-114125. Afecta a Storybook 8, 9, 10 y 11 alpha. Corregidas: 8.6.19, 9.1.21, 10.6.2 y 11.0.0-alpha.6. Qué puede hacer un atacante 👇 t.co/fPN9ReSVRH
localhost isn't a security boundary, it's a port any tab can knock on... storybook dev servers v8 through 11 alpha, new mcp addon included, let a malicious website change files in your project while running. critical, GHSA-f2ph-cmg5-wxc8. upgrade before the next run
