Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. ## Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook Recent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust. ## Recommended actions ### Upgrade Storybook Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix. - 11.0.0-alpha.6 - 10.6.2 - 9.1.21 - 8.6.19 ### Review potentially breaking changes Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related featu
- Products
- @storybook/addon-mcp, @storybook/addon-vitest, @storybook/core, @storybook/core-server, @storybook/experimental-addon-test, storybook
- Affected versions
- Not specified
- Fixed versions
- 10.6.2, 11.0.0-alpha.6, 8.6.19, 9.1.21
- CVEs
- CVE-2026-114125
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 15:36 UTC · Revision 1
Source evidence
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
core-osv · Original sourcePublished 21 Oct 2026, 17:23 UTC
**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. ## Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook Recent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust. ## Recommended actions ### Upgrade Storybook Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix. - 11.0.0-alpha.6 - 10.6.2 - 9.1.21 - 8.6.19 ### Review potentially breaking changes Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related featu
osv:GHSA-f2ph-cmg5-wxc8
storybook
Fixed versions: 8.6.19
storybook
Fixed versions: 9.1.21
storybook
Fixed versions: 10.6.2
storybook
Fixed versions: 11.0.0-alpha.6
@storybook/core
Fixed versions: 8.6.19
@storybook/core-server
Fixed versions: 8.6.19
@storybook/experimental-addon-test
Fixed versions: 8.6.19
@storybook/addon-vitest
Fixed versions: 9.1.21
@storybook/addon-vitest
Fixed versions: 10.6.2
@storybook/addon-vitest
Fixed versions: 11.0.0-alpha.6
@storybook/addon-mcp
Fixed versions: 10.6.2
@storybook/addon-mcp
Fixed versions: 11.0.0-alpha.6
Complete source record
{
"id": "dff68191f0ec127ab8327ae5765ef876a868cc9a620c35b25e732f4dddfcee5d",
"url": "https://osv.dev/vulnerability/GHSA-f2ph-cmg5-wxc8",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites",
"summary": "**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. ## Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook Recent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust. ## Recommended actions ### Upgrade Storybook Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix. - 11.0.0-alpha.6 - 10.6.2 - 9.1.21 - 8.6.19 ### Review potentially breaking changes Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related featu",
"evidence": "osv:GHSA-f2ph-cmg5-wxc8",
"products": [
{
"name": {
"value": "storybook",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.6.19",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "storybook",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.1.21",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "storybook",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.6.2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "storybook",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "11.0.0-alpha.6",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "@storybook/core",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.6.19",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "@storybook/core-server",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.6.19",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "@storybook/experimental-addon-test",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.6.19",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "@storybook/addon-vitest",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.1.21",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "@storybook/addon-vitest",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.6.2",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "@storybook/addon-vitest",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "11.0.0-alpha.6",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "@storybook/addon-mcp",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "10.6.2",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "@storybook/addon-mcp",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "11.0.0-alpha.6",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "GHSA-f2ph-cmg5-wxc8",
"aliases": [
"CVE-2026-114125",
"GHSA-f2ph-cmg5-wxc8"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
}
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.6.19"
}
]
}
],
"package": {
"name": "storybook",
"purl": "pkg:npm/storybook",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.1.21"
}
]
}
],
"package": {
"name": "storybook",
"purl": "pkg:npm/storybook",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.6.2"
}
]
}
],
"package": {
"name": "storybook",
"purl": "pkg:npm/storybook",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "11.0.0-alpha.0"
},
{
"fixed": "11.0.0-alpha.6"
}
]
}
],
"package": {
"name": "storybook",
"purl": "pkg:npm/storybook",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.6.19"
}
]
}
],
"package": {
"name": "@storybook/core",
"purl": "pkg:npm/%40storybook/core",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.6.19"
}
]
}
],
"package": {
"name": "@storybook/core-server",
"purl": "pkg:npm/%40storybook/core-server",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.6.19"
}
]
}
],
"package": {
"name": "@storybook/experimental-addon-test",
"purl": "pkg:npm/%40storybook/experimental-addon-test",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.1.21"
}
]
}
],
"package": {
"name": "@storybook/addon-vitest",
"purl": "pkg:npm/%40storybook/addon-vitest",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.6.2"
}
]
}
],
"package": {
"name": "@storybook/addon-vitest",
"purl": "pkg:npm/%40storybook/addon-vitest",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "11.0.0-alpha.0"
},
{
"fixed": "11.0.0-alpha.6"
}
]
}
],
"package": {
"name": "@storybook/addon-vitest",
"purl": "pkg:npm/%40storybook/addon-vitest",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "10.6.0"
},
{
"fixed": "10.6.2"
}
]
}
],
"package": {
"name": "@storybook/addon-mcp",
"purl": "pkg:npm/%40storybook/addon-mcp",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "11.0.0-alpha.0"
},
{
"fixed": "11.0.0-alpha.6"
}
]
}
],
"package": {
"name": "@storybook/addon-mcp",
"purl": "pkg:npm/%40storybook/addon-mcp",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2ph-cmg5-wxc8/GHSA-f2ph-cmg5-wxc8.json"
}
}
],
"modified": "2026-10-21T17:35:19.889160714Z",
"provider": "osv",
"references": [
"https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
"https://github.com/storybookjs/storybook/pull/36726",
"https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da",
"https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178",
"https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb",
"https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e",
"https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed",
"https://github.com/storybookjs/storybook",
"https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
"https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6",
"https://github.com/storybookjs/storybook/releases/tag/v8.6.19",
"https://github.com/storybookjs/storybook/releases/tag/v9.1.21"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1021",
"CWE-22",
"CWE-346",
"CWE-441",
"CWE-749",
"CWE-862",
"CWE-94",
"CWE-96"
],
"severity": "CRITICAL",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-10-21T17:23:29Z"
}
},
"related_cves": [
{
"value": "CVE-2026-114125",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 397805,
"published_at": "2026-10-21T17:23:29+00:00"
}