Description
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Published: 2026-10-21
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via injected web page events
Action: Patch Immediately
AI Analysis

Impact

A flaw in Storybook’s iframe embedding fails to enforce origin validation, allowing a malicious website to send crafted messages that reach the running preview. The attacker can inject code that alters story files, and if those files are later executed by a local runtime, arbitrary code runs with the developer’s privileges. The weakness stems from improper input validation (CWE‑1021), unexpected application responses (CWE‑346), and code generation controls (CWE‑94). The reported CVSS score of 8.6 indicates a high severity impact, giving attackers the ability to compromise both confidentiality and integrity of the dev environment.

Affected Systems

Storybook for JavaScript (storybookjs:storybook) versions from 8.0.0 up to 8.6.19, 9.1.21, 10.6.2, and 11.0.0‑alpha.6 are affected. Any instance of those releases running a development server that serves preview pages is vulnerable.

Risk and Exploitability

The vulnerability is high‑risk but requires the developer to visit a malicious website and interact with the preview. The EPSS is not available, so the exact probability of exploitation is unknown, but the absence of KEV listing suggests no known large‑scale exploitation yet. However, the potential to execute arbitrary code with developer privileges makes the exposure significant for developers in collaborative or open‑source projects.

Generated by OpenCVE AI on October 22, 2026 at 03:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Storybook to v8.6.19, v9.1.21, v10.6.2, or v11.0.0‑alpha.6 or later to apply the patch
  • If an upgrade cannot be performed immediately, host the preview on a network that rejects cross‑origin messages, or serve the preview in a sandboxed iframe with strict origin checks, to reduce exposure to malicious web content
  • Maintain a code review process for any changes to story files, and restrict the execution rights of your local runtime to mitigate the impact if an attacker manipulates those files

Generated by OpenCVE AI on October 22, 2026 at 03:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-f2ph-cmg5-wxc8 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
History

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Thu, 22 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Storybookjs
Storybookjs storybook
Vendors & Products Storybookjs
Storybookjs storybook

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Title Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Weaknesses CWE-1021
CWE-346
CWE-94
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Storybookjs Storybook
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T17:13:06.610Z

Reserved: 2026-10-20T21:53:58.472Z

Link: CVE-2026-114125

cve-icon Vulnrichment

Updated: 2026-10-28T17:12:58.751Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T18:17:24.957

Modified: 2026-10-28T18:17:10.290

Link: CVE-2026-114125

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-21T17:08:12Z

Links: CVE-2026-114125 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T11:15:04Z

Weaknesses
  • CWE-1021

    Improper Restriction of Rendered UI Layers or Frames

  • CWE-346

    Origin Validation Error

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')