CVE-2026-114125
Fixed in a distro release EPSS <1%CVSS 8.6
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Products: storybookjs storybook
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @storybook/addon-mcp | 10.6.2 |
| npm | @storybook/addon-mcp | 11.0.0-alpha.6 |
| npm | @storybook/addon-vitest | 9.1.21 |
| npm | @storybook/addon-vitest | 10.6.2 |
| npm | @storybook/addon-vitest | 11.0.0-alpha.6 |
| npm | @storybook/core | 8.6.19 |
| npm | @storybook/core-server | 8.6.19 |
| npm | @storybook/experimental-addon-test | 8.6.19 |
| npm | storybook | 8.6.19 |
| npm | storybook | 9.1.21 |
| npm | storybook | 10.6.2 |
| npm | storybook | 11.0.0-alpha.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | langfuse-3-worker | 3.225.12-r4 |
| Chainguard | langfuse-4-worker | 4.68.0-r0 |
| Chainguard | langfuse-fips-3-worker | 3.225.12-r4 |
| Chainguard | langfuse-fips-4-worker | 4.68.0-r0 |
| Wolfi | langfuse-3-worker | 3.225.12-r4 |