Storybook dev server · Disclosed

Storybook patches code injection from malicious websites; no known exploitation

Oct 20, 2026 · 1 min read

Missing origin validation in Storybook's preview lets a malicious website inject code into a running dev server, with arbitrary code execution as the worst case (CVSS 9.4 per the GitHub advisory). The Storybook team says it is not aware of exploitation in the wild. Upgrade to 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 before running storybook dev again.

By HIFY Radar newsroom Updated 10/26/2026 01:20 PM Get this every day →← Back to the feed 3 sources

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Storybook fixed a flaw that lets malicious websites make unauthorized changes to a developer's project files while a Storybook dev server is running. In the team's worst-case scenario, a changed file could be executed by a local runtime, leading to arbitrary code execution with the developer's privileges. The advisory was published October 12, 2026 and updated October 21, 2026.

Why it matters

The risk hits engineering teams running affected Storybook dev server versions (8.x through the 11 alphas) and opening them in a browser. A malicious file written to the project could run on the developer's machine, exposing source code and local credentials. Built versions of Storybook are unaffected, according to the advisory.

What to do

Upgrade Storybook to 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 before running storybook dev again. Until you upgrade, do not run an affected dev server. Review the changed default network behaviors and update the Visual Tests addon to 5.5.1 or later.

For the technical team

CVE: CVE-2026-114125
Affected: Storybook dev server (storybook / @storybook/core-server e addons) · storybook, @storybook/core, @storybook/core-server and @storybook/experimental-addon-test >= 8.0.0 < 8.6.19; storybook and @storybook/addon-vitest >= 9.0.0 < 9.1.21; storybook, @storybook/addon-vitest and @storybook/addon-mcp >= 10.0.0 < 10.6.2 (addon-mcp from 10.6.0); storybook and addons >= 11.0.0-alpha.0 < 11.0.0-alpha.6.
Exploitation: The Storybook team states it has received no evidence of exploitation in real Storybook projects (advisory GHSA-f2ph-cmg5-wxc8, published October 12, 2026 and updated October 21, 2026). No PoC or KEV listing cited in the sources.
Fix: Patched versions: 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6. Temporary mitigation: do not run an affected dev server until patched and deny untrusted websites the browser permission to connect to localhost. Update the Visual Tests addon to 5.5.1 or later.
Vector: Missing origin validation in Storybook preview postMessage communication. An attacker-controlled website embeds the preview iframe of a running dev server and sends events to the server on the developer's machine. Requires the dev server running and the browser open (passive user interaction). GitHub CVSS v4 metrics: network vector, low complexity, no attack requirements, no privileges, high impact on confidentiality, integrity and availability. Recent Chrome and Firefox versions ask permission before a website connects to a localhost service, which reduces but does not remove the risk.
More details: CVE-2026-114125. Timeline: responsible disclosure received September 30, 2026 showing how a malicious website embeds the preview iframe and sends events to the dev server; the team combined it with an ongoing security audit and fixed every layer of the worst-case scenario, which requires exploiting a chain of many vulnerabilities, some never disclosed. Default changes in patched versions: network iframe embedding disabled by default (security.insecureRemoteIframeEmbed flag), preview and manager reject postMessage from unknown origins (security.insecureIframeMessaging flag), highlight event API reworked. Per the v10.6.2 release notes, the patch also fixes GHSA-px85-f4q5-jh77.