Skip to content
fr Sign in
8.6 High

CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in isolation

Description

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

Affected products and versions

Product Affected versions Fixed in
storybook 11.0 11.0.0-alpha.0 → < 11.0.0-alpha.6 11.0.0-alpha.6
storybook 10.0 10.0.0 → < 10.6.2 10.6.2
storybook 9.0 9.0.0 → < 9.1.21 9.1.21
storybook 8.0 8.0.0 → < 8.6.19 8.6.19

References

Timeline

  1. Published
  2. Last modified

Other CVEs of storybook

The 4 CVEs of storybook →
CVE-2026-114126 Storybook is a frontend workshop for building user interface components and pages in isolation 8.7 High CVE-2026-27148 Storybook is a frontend workshop for building user interface components and pages in isolation 8.9 High CVE-2025-68429 Storybook is a frontend workshop for building user interface components and pages in isolation 7.3 High
Track this CVE