CVE-2026-114125 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114125?
CVE-2026-114125 is a high-severity vulnerability in storybookjs storybook, published on 21 Oct 2026.
Official description
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Which versions are affected by CVE-2026-114125?
24 open source packages ship an affected version, including storybook, @storybook/addon-mcp and @storybook/addon-vitest.
| Package | Affected | Fixed in |
|---|---|---|
storybook npm | From 10.0.0 | 10.6.2 |
storybook npm | From 10.0.0 | 10.6.2 |
storybook npm | From 11.0.0-alpha.0 | 11.0.0-alpha.6 |
storybook npm | From 11.0.0-alpha.0 | 11.0.0-alpha.6 |
storybook npm | From 8.0.0 | 8.6.19 |
storybook npm | From 8.0.0 | 8.6.19 |
18 more packages
storybook npm | From 9.0.0 | 9.1.21 |
storybook npm | From 9.0.0 | 9.1.21 |
@storybook/addon-mcp npm | From 10.6.0 | 10.6.2 |
@storybook/addon-mcp npm | From 10.6.0 | 10.6.2 |
@storybook/addon-mcp npm | From 11.0.0-alpha.0 | 11.0.0-alpha.6 |
@storybook/addon-mcp npm | From 11.0.0-alpha.0 | 11.0.0-alpha.6 |
@storybook/addon-vitest npm | From 10.0.0 | 10.6.2 |
@storybook/addon-vitest npm | From 10.0.0 | 10.6.2 |
@storybook/addon-vitest npm | From 11.0.0-alpha.0 | 11.0.0-alpha.6 |
@storybook/addon-vitest npm | From 11.0.0-alpha.0 | 11.0.0-alpha.6 |
@storybook/addon-vitest npm | From 9.0.0 | 9.1.21 |
@storybook/addon-vitest npm | From 9.0.0 | 9.1.21 |
@storybook/core npm | From 8.0.0 | 8.6.19 |
@storybook/core npm | From 8.0.0 | 8.6.19 |
@storybook/core-server npm | From 8.0.0 | 8.6.19 |
@storybook/core-server npm | From 8.0.0 | 8.6.19 |
@storybook/experimental-addon-test npm | From 8.0.0 | 8.6.19 |
@storybook/experimental-addon-test npm | From 8.0.0 | 8.6.19 |
How do I fix CVE-2026-114125?
Upgrade storybook to a fixed version for your release line: 10.6.2, 11.0.0-alpha.6, 8.6.19 or 9.1.21.
Is CVE-2026-114125 being exploited?
There is no known exploitation of CVE-2026-114125 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1793185389, GHSA-f2ph-cmg5-wxc8, ROOT-APP-NPM-CVE-2026-114125.