[high] Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)

Thu, 22 Oct 2026 12:43:45 GMT

Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.

Status: closed · Patch: patched · Fixed in: 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6

Latest updates:

2026-10-22: Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile. (source)
2026-10-21: Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again. (source)
2026-10-12: Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour). (source)

CVEs: CVE-2026-114125

pwn.watch: Storybook incident updates

[high] Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)