# CVE-2026-114125: Storybook missing origin validation in preview allows code injection

Source: https://junglewise.ai/threats/cve-2026-114125-storybook-missing-origin-validation-in-storybook-preview-allows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114125 · Severity: critical · CVSS 4 · Published 2026-10-21

Storybook is a development tool for building user interface components. A malicious website can interact with a developer's running Storybook dev server to inject code and modify project files. If those modified files are executed, an attacker could gain the developer's privileges and run arbitrary code on their machine.

Technologies: [storybook (npm)](https://junglewise.ai/threats/technologies/npm-storybook). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-114125 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114125 being exploited in the wild.

**How severe is CVE-2026-114125?** Critical severity, with a CVSS score of 4, published 21 October 2026.

**Which products and versions are affected?** @storybook/core (npm) >= 8.0.0, < 8.6.19, SEMVER:introduced=8.0.0,fixed=8.6.19; @storybook/core-server (npm) >= 8.0.0, < 8.6.19, SEMVER:introduced=8.0.0,fixed=8.6.19; @storybook/experimental-addon-test (npm) >= 8.0.0, < 8.6.19, SEMVER:introduced=8.0.0,fixed=8.6.19; storybook (npm) >= 8.0.0, < 8.6.19, SEMVER:introduced=8.0.0,fixed=8.6.19; and 3 more.

**Is there a fix for CVE-2026-114125?** Yes. @storybook/core (npm): upgrade to 8.6.19 or later; @storybook/core-server (npm): upgrade to 8.6.19 or later; @storybook/experimental-addon-test (npm): upgrade to 8.6.19 or later; storybook (npm): upgrade to 8.6.19 or later; @Storybook/Addon-Mcp: upgrade to 10.6.2 or later; @Storybook/Addon-Vitest: upgrade to 9.1.21 or later. Until then: Do not run an affected Storybook dev server until you can upgrade. If you must run a dev server temporarily, do not grant browser permission for websites to connect to localhost services, and avoid visiting untrusted websites while the server is running. Alternatively, if you rely on iframe embedding from a separate web app, ensure that app runs on localhost. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114125 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114125?** Check whether you run @storybook/core (npm), @storybook/core-server (npm), @storybook/experimental-addon-test (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @storybook/core (npm): upgrade to 8.6.19 or later

  ```sh
  npm install @storybook/core@8.6.19
  ```

- @storybook/core-server (npm): upgrade to 8.6.19 or later

  ```sh
  npm install @storybook/core-server@8.6.19
  ```

- @storybook/experimental-addon-test (npm): upgrade to 8.6.19 or later

  ```sh
  npm install @storybook/experimental-addon-test@8.6.19
  ```

- storybook (npm): upgrade to 8.6.19 or later

  ```sh
  npm install storybook@8.6.19
  ```

- @Storybook/Addon-Mcp: upgrade to 10.6.2 or later
- @Storybook/Addon-Vitest: upgrade to 9.1.21 or later

Do not run an affected Storybook dev server until you can upgrade. If you must run a dev server temporarily, do not grant browser permission for websites to connect to localhost services, and avoid visiting untrusted websites while the server is running. Alternatively, if you rely on iframe embedding from a separate web app, ensure that app runs on localhost.

## Technical details

The vulnerability stems from missing origin validation in Storybook's preview iframe postMessage handlers. An attacker can embed a Storybook dev server preview iframe from a malicious website and send forged messages to modify files on the developer's system. The attack requires user interaction and relies on exploiting a sequence of vulnerabilities; exploitation in the wild has not been observed.

## Affected products

- Storybook Storybook before 8.6.19, 9.x before 9.1.21, 10.x before 10.6.2, 11.x before 11.0.0-alpha.6

## Identifiers

- CVE-2026-114125
- GHSA-f2ph-cmg5-wxc8

## Timeline

- 2026-09-30: disclosed: Responsible disclosure of missing origin validation
- 2026-10-21: advisory

## Related threats

- [Storybook WebSocket token exposure and code execution](https://junglewise.ai/threats/cve-2026-114126-storybook-is-a-frontend-workshop-for-building-user-interface)
- [Storybook WebSocket hijacking and RCE in development server](https://junglewise.ai/threats/cve-2026-27148-storybook-websocket-hijacking-and-rce-in-development-server)
- [Storybook environment variable exposure in build artifacts](https://junglewise.ai/threats/cve-2025-68429-storybook-environment-variable-exposure-in-build-artifacts)