VDB

CVE-2026-114125

CVE-2026-114125 PUBLISHED CVSS 8.6 HIGH

Reported by GitHub_M · Published October 21, 2026

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

Risk Scores

CVSS 4.0
8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
storybookjsstorybook>= 8.0.0, < 8.6.19, >= 9.0.0, < 9.1.21, >= 10.0.0, < 10.6.2
chainguardlangfuse-fips-40
chainguardlangfuse-40
chainguardlangfuse-30
storybookaddon-vitest11.0.0-alpha.0, 9.0.0, 10.0.0
storybookcore8.0.0
storybookcore-server8.0.0
storybookexperimental-addon-test8.0.0
storybookjsstorybook8.0.0, 9.0.0, 10.0.0
npmstorybook11.0.0-alpha.0, 8.0.0, 9.0.0
wolfilangfuse-30
storybookaddon-mcp11.0.0-alpha.0, 10.6.0
chainguardlangfuse-fips-30

Timeline

  • Oct 21, 2026 CVE Published
  • Oct 22, 2026 EPSS Score
  • Oct 22, 2026 Coalition ESS Score
  • Oct 25, 2026 EPSS Score
  • Oct 27, 2026 EPSS Score
  • Oct 28, 2026 CVE Updated
  • Oct 29, 2026 EPSS Score
  • Oct 31, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›