Key points
- CVE-2026-114125 affects Storybook versions 8.0.0 through 11.0.0-alpha.5.
- The vulnerability enables arbitrary code execution with developer privileges.
- Patches are available for all affected major versions, including 8.6.19 and 9.1.21.
A flaw in Storybook’s development server allows malicious websites to inject events into the preview interface, potentially altering project files. According to GitHub advisory GHSA-f2ph-cmg5-wxc8, this issue arises from insufficient iframe embedding and message-origin restrictions. An attacker-controlled website can interact with the running preview if a developer visits it. This interaction can lead to unauthorized changes in story files within the developer’s local project.
If those modified files are subsequently executed by a local runtime, the attack results in arbitrary code execution. The code runs with the same privileges as the developer, as noted in the NVD record for CVE-2026-114125. The vulnerability is rated High with a CVSS score of 8.6. It relies on the developer actively visiting a malicious site and interacting with the injected interface.
By the numbers
- CVSS 8.6: The high severity score assigned to CVE-2026-114125 by the National Vulnerability Database.
- Four major version ranges: Versions 8, 9, 10, and 11-alpha contain the vulnerability before specific patch releases.
- Six patched versions: Specific builds like 8.6.19 and 10.6.2 resolve the issue across the affected lines.
What to watch
The GitHub advisory states that the Storybook team is not aware of exploitation in the wild. However, the attack vector requires a developer to visit a malicious website while the development server is active. Recent versions of Chrome and Firefox may prompt users for permission before a website connects to a localhost service. This browser feature reduces risk but does not eliminate it, according to the advisory. Users should not grant permission to untrusted sites.
Infection and persistence in general
Teams usually encounter this category of threat when developers access untrusted web content while local services are exposed. Attackers typically rely on browser permissions to bridge the gap between external sites and local development environments. Analysts should examine network logs for unexpected connections to localhost services from remote domains. They must also review browser permission histories to identify any granted access to untrusted origins. Checking for unauthorized file modifications in project directories is a standard step. Teams should verify that iframe embedding restrictions are enforced to prevent external sites from interacting with local previews.
What to do and how to stay safe: Storybook
- Upgrade Storybook to the latest patched version immediately, such as 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6.
- Avoid running affected Storybook development servers if an immediate upgrade is not possible.
- Do not grant browser permissions for localhost connections to websites you do not trust.
- Review project files for unauthorized changes if you suspect exposure to a malicious site.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Storybook versions are vulnerable to CVE-2026-114125?
Versions 8.0.0 to 8.6.18, 9.0.0 to 9.1.20, 10.0.0 to 10.6.1, and 11.0.0-alpha.0 to 11.0.0-alpha.5 are affected.
Is this vulnerability being exploited in the wild?
No, the GitHub advisory states that the Storybook team is not aware of any exploitation in the wild.
What happens if I visit a malicious site while the server is running?
A malicious site can interact with the preview, potentially changing story files and leading to arbitrary code execution.
