CVE-2026-114125

Name of the Vulnerable Software and Affected Versions Storybook versions 8.0.0 through 8.6.18 Storybook versions 9.0.0 through 9.1.20 Storybook versions 10.0.0 through 10.6.1 Storybook versions 11.0.0-alpha.0 through 11.0.0-alpha.5

Description Insufficient iframe embedding and message-origin restrictions allow a malicious website to interact with the preview of a running Storybook development server. If a developer visits a malicious site and interacts with an injected interface, an attacker can trigger unauthorized changes to story files. If these modified files are later executed by a local runtime, it can lead to arbitrary code execution with the developer's privileges. The issue involves the postMessage API and the highlight event signature, which was too permissive and could be used to trigger arbitrary events processed by the development server.

Recommendations Upgrade Storybook to version 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6. As a temporary mitigation, do not run a Storybook development server until the update is applied. Avoid granting localhost connection permissions to untrusted websites in the web browser.