Storybook Fixes CVSS 9.4 Dev Server Flaw That Lets Malicious Sites Inject Code
Do Son 
TL;DR
Storybook has patched CVE-2026-114125, a CVSS 9.4 Storybook dev server vulnerability that lets a malicious website change files in a developer’s project. Under further conditions, the attack can lead to code execution with the developer’s privileges. Fixed versions are 11.0.0-alpha.6, 10.6.2, 9.1.21 and 8.6.19.
- CVE: CVE-2026-114125
- CVSS: 8.6 (High · CVSSv4)
- Product: storybookjs storybook
- Affected: >= 8.0.0, < 8.6.19, >= 9.0.0, < 9.1.21, >= 10.0.0, < 10.6.2, >= 11.0.0-alpha.0, < 11.0.0-alpha.6
- Impact: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
- Status: No confirmed exploitation yet
- EPSS: 0.4% (30-day)
- Action: See vendor advisory
Why It Matters
Storybook is a popular frontend workshop for building UI components in isolation. According to the project, “thousands of teams use it for UI development, testing, and documentation.” Developers often run the dev server for hours while browsing the web, which makes this attack path realistic.
How the Attack Works
The Storybook security advisorydescribes the worst case. “An attacker-controlled website can interact with the preview of a running Storybook dev server.” With user interaction, it “may cause the dev server to make unauthorized changes to story files.”
If a local runtime later runs a changed file, the code injection turns into code execution with the developer’s rights. However, the chain is not simple. Storybook says it “relies on correctly exploiting a sequence of many vulnerabilities.”
How it was found
The Storybook team received a responsible disclosure about this code injection risk on September 30. It then combined that report with findings from an ongoing audit. As a result, the fix closes every layer of this Storybook dev server vulnerability, not just the reported entry point.
Exploitation status
Storybook says, “We are not aware of exploitation in the wild.” No public proof-of-concept has been confirmed.
Who is safe
Built Storybook sites are not affected. Neither are dev servers that never open in a browser, such as headless automation or MCP clients. Meanwhile, recent Chrome and Firefox versions may ask before a site connects to localhost. That “reduces the risk, but does not remove it.”
Affected Versions
- storybook: 8.0.0 to before 8.6.19, 9.0.0 to before 9.1.21, 10.0.0 to before 10.6.2, and 11.0.0-alpha.0 to before alpha.6
- @storybook/core, core-server and experimental-addon-test: 8.0.0 to before 8.6.19
- @storybook/addon-vitest: 9.x before 9.1.21, 10.x before 10.6.2 and 11 alphas before alpha.6
- @storybook/addon-mcp: 10.6.0 to before 10.6.2, and 11 alphas before alpha.6
Patch and Mitigation Steps
- Upgrade before you run storybook dev again.
- If you cannot upgrade, do not run an affected dev server.
- Deny localhost access prompts from untrusted websites.
- Update Chromatic’s Visual Tests addon to 5.5.1 or later.
Expect breaking changes
The fix changes several defaults. Dev servers now block iframe embedding from other host names and reject postMessage traffic from unknown origins. Feature flags can restore old behavior, but Storybook urges caution. In short, patch this Storybook dev server vulnerability now and review the new flags before you re-enable anything.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
