cyfenced.com →

[ CVE-2026-114125 · Published 21 Oct 2026 ]

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

CVSS 8.6 EPSS <1%Fix available

[ Description ]Official description

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

[ Fixes ]Fixes and patches

  • storybook 8.6.19Fixed version · GitHub Advisories · npm package storybook: upgrade to 8.6.19 or later (affected >= 8.0.0, < 8.6.19)
  • storybook 9.1.21Fixed version · GitHub Advisories · npm package storybook: upgrade to 9.1.21 or later (affected >= 9.0.0, < 9.1.21)
  • storybook 10.6.2Fixed version · GitHub Advisories · npm package storybook: upgrade to 10.6.2 or later (affected >= 10.0.0, < 10.6.2)
  • storybook 11.0.0-alpha.6Fixed version · GitHub Advisories · npm package storybook: upgrade to 11.0.0-alpha.6 or later (affected >= 11.0.0-alpha.0, < 11.0.0-alpha.6)
  • @storybook/core 8.6.19Fixed version · GitHub Advisories · npm package @storybook/core: upgrade to 8.6.19 or later (affected >= 8.0.0, < 8.6.19)
  • @storybook/core-server 8.6.19Fixed version · GitHub Advisories · npm package @storybook/core-server: upgrade to 8.6.19 or later (affected >= 8.0.0, < 8.6.19)
  • @storybook/experimental-addon-test 8.6.19Fixed version · GitHub Advisories · npm package @storybook/experimental-addon-test: upgrade to 8.6.19 or later (affected >= 8.0.0, < 8.6.19)
  • @storybook/addon-vitest 9.1.21Fixed version · GitHub Advisories · npm package @storybook/addon-vitest: upgrade to 9.1.21 or later (affected >= 9.0.0, < 9.1.21)
  • @storybook/addon-vitest 10.6.2Fixed version · GitHub Advisories · npm package @storybook/addon-vitest: upgrade to 10.6.2 or later (affected >= 10.0.0, < 10.6.2)
  • @storybook/addon-vitest 11.0.0-alpha.6Fixed version · GitHub Advisories · npm package @storybook/addon-vitest: upgrade to 11.0.0-alpha.6 or later (affected >= 11.0.0-alpha.0, < 11.0.0-alpha.6)
  • @storybook/addon-mcp 10.6.2Fixed version · GitHub Advisories · npm package @storybook/addon-mcp: upgrade to 10.6.2 or later (affected >= 10.6.0, < 10.6.2)
  • @storybook/addon-mcp 11.0.0-alpha.6Fixed version · GitHub Advisories · npm package @storybook/addon-mcp: upgrade to 11.0.0-alpha.6 or later (affected >= 11.0.0-alpha.0, < 11.0.0-alpha.6)

[ Packages ]Affected open-source packages

  • storybook npmAffected >= 8.0.0, < 8.6.19 · fixed in 8.6.19 · GHSA-f2ph-cmg5-wxc8
  • storybook npmAffected >= 9.0.0, < 9.1.21 · fixed in 9.1.21 · GHSA-f2ph-cmg5-wxc8
  • storybook npmAffected >= 10.0.0, < 10.6.2 · fixed in 10.6.2 · GHSA-f2ph-cmg5-wxc8
  • storybook npmAffected >= 11.0.0-alpha.0, < 11.0.0-alpha.6 · fixed in 11.0.0-alpha.6 · GHSA-f2ph-cmg5-wxc8
  • @storybook/core npmAffected >= 8.0.0, < 8.6.19 · fixed in 8.6.19 · GHSA-f2ph-cmg5-wxc8
  • @storybook/core-server npmAffected >= 8.0.0, < 8.6.19 · fixed in 8.6.19 · GHSA-f2ph-cmg5-wxc8
  • @storybook/experimental-addon-test npmAffected >= 8.0.0, < 8.6.19 · fixed in 8.6.19 · GHSA-f2ph-cmg5-wxc8
  • @storybook/addon-vitest npmAffected >= 9.0.0, < 9.1.21 · fixed in 9.1.21 · GHSA-f2ph-cmg5-wxc8
  • @storybook/addon-vitest npmAffected >= 10.0.0, < 10.6.2 · fixed in 10.6.2 · GHSA-f2ph-cmg5-wxc8
  • @storybook/addon-vitest npmAffected >= 11.0.0-alpha.0, < 11.0.0-alpha.6 · fixed in 11.0.0-alpha.6 · GHSA-f2ph-cmg5-wxc8
  • @storybook/addon-mcp npmAffected >= 10.6.0, < 10.6.2 · fixed in 10.6.2 · GHSA-f2ph-cmg5-wxc8
  • @storybook/addon-mcp npmAffected >= 11.0.0-alpha.0, < 11.0.0-alpha.6 · fixed in 11.0.0-alpha.6 · GHSA-f2ph-cmg5-wxc8

[ References ]References