{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T21:29:54.052Z",
  "tag": {
    "id": "storybook",
    "label": "Storybook",
    "isStack": false,
    "url": "https://pwn.watch/t/storybook",
    "feed": "https://pwn.watch/t/storybook/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "storybook-dev-server-cve-2026-114125",
      "title": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125",
      "json": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Storybook (dev server)",
      "tags": [
        "node",
        "npm",
        "devtools",
        "storybook",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-114125"
      ],
      "affectedVersions": [
        "storybook / @storybook/core / @storybook/core-server >= 8.0.0 < 8.6.19",
        "storybook >= 9.0.0 < 9.1.21",
        "storybook >= 10.0.0 < 10.6.2",
        "storybook >= 11.0.0-alpha.0 < 11.0.0-alpha.6",
        "@storybook/addon-vitest and @storybook/addon-mcp (matching ranges)"
      ],
      "fixedVersions": [
        "8.6.19",
        "9.1.21",
        "10.6.2",
        "11.0.0-alpha.6"
      ],
      "startedAt": "2026-10-21",
      "closedAt": "2026-10-22",
      "updatedAt": "2026-10-22T12:43:45.000Z",
      "summary": "Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "YorkDev",
      "handle": "YoDevp",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2108041001340112897/pVqNB6Ej_bigger.jpg",
      "text": "🚨 Si usas Storybook, actualiza antes de volver a correr el dev server: publicaron una vulnerabilidad crítica (CVSS v4 9.4), CVE-2026-114125.\n\nAfecta a Storybook 8, 9, 10 y 11 alpha.\nCorregidas: 8.6.19, 9.1.21, 10.6.2 y 11.0.0-alpha.6.\n\nQué puede hacer un atacante 👇 https://t.co/fPN9ReSVRH",
      "date": "2026-10-22T12:43:45.000Z",
      "url": "https://x.com/YoDevp/status/2113249953879593338",
      "media": [],
      "incident": "storybook-dev-server-cve-2026-114125"
    },
    {
      "authorName": "Tim Notes",
      "handle": "timwork_notes",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2107197400041340928/TMXhl773_bigger.jpg",
      "text": "localhost isn't a security boundary, it's a port any tab can knock on... storybook dev servers v8 through 11 alpha, new mcp addon included, let a malicious website change files in your project while running. critical, GHSA-f2ph-cmg5-wxc8. upgrade before the next run",
      "date": "2026-10-22T09:30:20.000Z",
      "url": "https://x.com/timwork_notes/status/2113201277933109352",
      "media": [],
      "incident": "storybook-dev-server-cve-2026-114125"
    }
  ],
  "changes": [
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile.",
      "body": null,
      "sourceUrl": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again.",
      "body": null,
      "sourceUrl": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-12",
      "title": "Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour).",
      "body": null,
      "sourceUrl": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-30",
      "title": "Storybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server.",
      "body": null,
      "sourceUrl": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    }
  ]
}