CVE-2026-114125

UNKNOWN 0.0

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

CWE	CWE-94 CWE-346 CWE-1021
Vendor	storybookjs
Product	storybook
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for storybookjs storybook

Be the first to know when new unknown vulnerabilities affecting storybookjs storybook are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

storybookjs / storybook

>= 8.0.0, < 8.6.19 >= 9.0.0, < 9.1.21 >= 10.0.0, < 10.6.2 >= 11.0.0-alpha.0, < 11.0.0-alpha.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗