CVE-2026-114125 in storybook
Summary
by MITRE • 10/22/2026
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
Storybook serves as a critical frontend workshop for developing user interface components and pages in isolation, allowing developers to build UIs independently of the main application logic. However, versions ranging from 8.0.0 through 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6 contain a significant security flaw related to insufficient iframe embedding controls and inadequate message-origin restrictions. This architectural weakness allows malicious websites to interact with the preview environment of a running Storybook development server. The vulnerability stems from the fact that the preview window does not strictly enforce origin checks on incoming messages, thereby permitting cross-site scripting vectors where an attacker can inject events into the developer's active session.
The operational impact of this flaw is severe because it facilitates unauthorized modifications to story files within the local environment. For an attack to succeed, a developer must visit a malicious website while their Storybook development server is running and interacting with the preview pane. Once on the malicious site, the attacker can leverage injected interfaces to send crafted events that bypass security boundaries. These events allow the attacker to manipulate the state of the UI components or alter story configurations directly in memory. If these altered states are saved back to disk or if a modified file is subsequently executed by the local runtime environment during development, it leads to arbitrary code execution with the privileges of the developer running the Storybook instance.
This vulnerability aligns closely with CWE-79, which covers improper neutralization of input during web page generation known as cross-site scripting, and specifically relates to insufficient iframe embedding restrictions often categorized under CWE-1021 in contexts involving frame buster failures or weak origin validation. From a tactical perspective, this attack vector maps to the ATT&CK technique T1059, Command and Scripting Interpreter, particularly when considering how local execution is triggered via manipulated files. The lack of strict same-origin policy enforcement for postMessage communications allows an external domain to control internal application logic, effectively bypassing standard browser security models designed to isolate content from different origins.
Mitigation strategies primarily involve upgrading the Storybook framework to patched versions 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 and later, where these origin checks have been strengthened. In environments where immediate patching is not feasible, developers should ensure that the Storybook preview window is never opened in a context accessible to untrusted third-party sites. Additionally, implementing strict Content Security Policy headers can help restrict message origins and prevent unauthorized scripts from executing within the iframe environment. It is also advisable for development teams to treat their local development servers with the same security rigor as production environments, recognizing that compromised dev tools pose a direct risk of remote code execution on the developer's machine.