CVE-2026-114125

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Storybook Preview

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114125

EUVD

EUVD-2026-107393

Affected Vendors & Products

Vendor	Product	Version / Range
storybookjs	storybook	>= 8.0.0, < 8.6.19
storybookjs	storybook	>= 9.0.0, < 9.1.21
storybookjs	storybook	>= 10.0.0, < 10.6.2
storybookjs	storybook	>= 11.0.0-alpha.0, < 11.0.0-alpha.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability affects Storybook versions between 8.0.0 and 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6. A malicious website can interact with a running Storybook dev server's preview iframe due to insufficient iframe embedding and message-origin restrictions. Attacker-controlled events can reach the preview, potentially causing unauthorized changes to story files. If a changed file is executed locally, arbitrary code execution with the developer's privileges may occur.

Detection Guidance

Check if your Storybook version is below 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6. Run `npx storybook@latest --version` to check the installed version. If vulnerable, inspect network traffic for unexpected iframe embeddings or postMessage events from non-localhost origins.

Impact Analysis

If you visit a malicious website while Storybook's dev server is running, the attacker could modify your story files without permission. If you later execute these modified files locally, arbitrary code could run on your machine with your user privileges. Modern browsers may warn before allowing localhost connections, but the risk remains.

Mitigation Strategies

Upgrade Storybook to version 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 or later. Avoid running the Storybook dev server while visiting untrusted websites. Disable iframe embedding from non-localhost origins if not needed.

Hi! I’m here to help you understand CVE-2026-114125. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...