Multiple security vulnerabilities have been identified in Storybook, affecting development server deployments in version ranges beginning at 8.0.0, 9.0.0, 10.0.0, and 11.0.0-alpha.0. The issues affect development-server components and can allow attackers to inject code into project files. In the worst case, unauthorized file changes can lead to code execution with the developer's privileges. The overall risk is high for developers running affected development servers.
CVE-2026-114125 (CVSS 9.4 — Critical): A missing origin validation flaw in the Storybook preview allows a malicious website to interact with a running development server preview. With user interaction, a remote attacker can cause unauthorized changes to project files, and if a changed file is executed by a local runtime, the attack can lead to code execution with the developer's privileges.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Storybook, affecting development server deployments in version ranges beginning at 8.0.0, 9.0.0, 10.0.0, and 11.0.0-alpha.0. The issues affect development-server components and can allow attackers to inject code into project files. In the worst case, unauthorized file changes can lead to code execution with the developer's privileges. The overall risk is high for developers running affected development servers.
CVE-2026-114125 (CVSS 9.4 — Critical): A missing origin validation flaw in the Storybook preview allows a malicious website to interact with a running development server preview. With user interaction, a remote attacker can cause unauthorized changes to project files, and if a changed file is executed by a local runtime, the attack can lead to code execution with the developer's privileges.[emaillocker id="1283"]
CVE-2026-114126 (CVSS 8.7 — High): The Storybook development server exposes its WebSocket authentication token to clients that can load its pages, allowing a device on the same local network to obtain the token. Without user interaction, a local-network attacker can use the WebSocket to inject code into project files or create new files, potentially executing code on the developer's machine.
These vulnerabilities collectively present a serious risk to developers who run affected Storybook development servers, especially when browsing untrusted websites or connecting to untrusted local networks. The most exposed users are those using development-mode Storybook on shared networks or while visiting malicious sites. The general action is to treat these issues as high-priority security concerns in development environments.
We recommend you to update Storybook to version 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]