{"id":"CVE-2026-114125","title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","summary":"Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook develop…","severity":"high","cvss":8.6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-94","CWE-346","CWE-1021","CWE-22","CWE-96","CWE-441","CWE-749","CWE-862"],"vendor":"storybookjs","product":"storybook","affected":["storybook >= 8.0.0, < 8.6.19","storybook >= 9.0.0, < 9.1.21","storybook >= 10.0.0, < 10.6.2","storybook >= 11.0.0-alpha.0, < 11.0.0-alpha.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-28T17:12:45.621272Z"},"published":"2026-10-21","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:13:06.610Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114125","references":[{"url":"https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8","label":"https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8"},{"url":"https://github.com/storybookjs/storybook/pull/36726","label":"https://github.com/storybookjs/storybook/pull/36726"},{"url":"https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da","label":"https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da"},{"url":"https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178","label":"https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178"},{"url":"https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0","label":"https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0"},{"url":"https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e","label":"https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e"},{"url":"https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed","label":"https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed"},{"url":"https://github.com/storybookjs/storybook/releases/tag/v10.6.2","label":"https://github.com/storybookjs/storybook/releases/tag/v10.6.2"},{"url":"https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6","label":"https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6"},{"url":"https://github.com/storybookjs/storybook/releases/tag/v8.6.19","label":"https://github.com/storybookjs/storybook/releases/tag/v8.6.19"},{"url":"https://github.com/storybookjs/storybook/releases/tag/v9.1.21","label":"https://github.com/storybookjs/storybook/releases/tag/v9.1.21"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114125.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-114125"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558395"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114125"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114125"},{"url":"https://access.redhat.com/errata/RHSA-2026:88478"},{"url":"https://access.redhat.com/errata/RHSA-2026:88537"},{"url":"https://access.redhat.com/errata/RHSA-2026:88541"},{"url":"https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb"},{"url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8"}],"tags":["cve.org","csaf","vex","red-hat","ghsa","npm"],"epss":0.00385,"epssPercentile":0.32438,"aliases":["GHSA-f2ph-cmg5-wxc8"],"ecosystem":"npm","patched":["hardened_images"],"scores":{"cna":8.6,"vendor":8.8},"ingestedAt":"2026-10-21T18:09:27.264Z","slug":"CVE-2026-114125","body":"## Overview\n\nStorybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.\n\n## Affected\n\n- `storybook >= 8.0.0, < 8.6.19`\n- `storybook >= 9.0.0, < 9.1.21`\n- `storybook >= 10.0.0, < 10.6.2`\n- `storybook >= 11.0.0-alpha.0, < 11.0.0-alpha.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-114125)\n\nAffected packages:\n\n- `storybook >= 8.0.0, < 8.6.19`\n- `storybook >= 9.0.0, < 9.1.21`\n- `storybook >= 10.0.0, < 10.6.2`\n- `storybook >= 11.0.0-alpha.0, < 11.0.0-alpha.6`\n- `@storybook/core >= 8.0.0, < 8.6.19`\n- `@storybook/core-server >= 8.0.0, < 8.6.19`\n- `@storybook/experimental-addon-test >= 8.0.0, < 8.6.19`\n- `@storybook/addon-vitest >= 9.0.0, < 9.1.21`\n- `@storybook/addon-vitest >= 10.0.0, < 10.6.2`\n- `@storybook/addon-vitest >= 11.0.0-alpha.0, < 11.0.0-alpha.6`\n- `@storybook/addon-mcp >= 10.6.0, < 10.6.2`\n- `@storybook/addon-mcp >= 11.0.0-alpha.0, < 11.0.0-alpha.6`\n\nPatched in:\n\n- `storybook 8.6.19`\n- `storybook 9.1.21`\n- `storybook 10.6.2`\n- `storybook 11.0.0-alpha.6`\n- `@storybook/core 8.6.19`\n- `@storybook/core-server 8.6.19`\n- `@storybook/experimental-addon-test 8.6.19`\n- `@storybook/addon-vitest 9.1.21`\n- `@storybook/addon-vitest 10.6.2`\n- `@storybook/addon-vitest 11.0.0-alpha.6`\n- `@storybook/addon-mcp 10.6.2`\n- `@storybook/addon-mcp 11.0.0-alpha.6`\n\nSource: https://github.com/advisories/GHSA-f2ph-cmg5-wxc8\n\n## Vendor advisories\n\n- **RHSA-2026:88478** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88478)\n- **RHSA-2026:88537** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88537)\n- **RHSA-2026:88541** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88541)\n- **Red Hat VEX** · Important · affected: Node HealthCheck Operator, Red Hat Build of Podman Desktop · no fix planned: Node HealthCheck Operator, Red Hat Build of Podman Desktop · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114125.json)","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":230867,"id":"CVE-2026-114125","ts":1793211392574,"field":"cvss","old":"8.8","new":"8.6"},{"seq":228170,"id":"CVE-2026-114125","ts":1792758145683,"field":"cvss","old":"8.6","new":"8.8"},{"seq":228169,"id":"CVE-2026-114125","ts":1792758145683,"field":"severity","old":"critical","new":"high"}]}