The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
GHSA-f2ph-cmg5-wxc8: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
- Identifiers
- CVE-2026-114125GHSA-f2ph-cmg5-wxc8
- Published
- Record updated
- Affected
- @storybook/addon-mcp >= 11.0.0-alpha.0, < 11.0.0-alpha.6, fixed in 11.0.0-alpha.6
- @storybook/addon-mcp >= 10.6.0, < 10.6.2, fixed in 10.6.2
- @storybook/addon-vitest >= 11.0.0-alpha.0, < 11.0.0-alpha.6, fixed in 11.0.0-alpha.6
- and 2 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
A malicious website can cause unauthorized file changes in a developer's project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer's privileges. The source states that Storybook dev servers opened in a web browser are impacted, while built versions of Storybook and servers never opened in a browser are not.
Mitigation
Upgrade to a patched version before running `storybook dev` again: 11.0.0-alpha.6, 10.6.2, 9.1.21 or 8.6.19. If an upgrade is not possible immediately, do not run an affected Storybook dev server until the fix is applied. Storybook also changed default behavior in versions 8 and 9: iframe embedding over the network is disabled by default (feature flag `security.insecureRemoteIframeEmbed` re-enables it), postMessage from unknown origins is rejected in dev mode (feature flag `security.insecureIframeMessaging` disables this protection), and the `highlight` event signature changed, so the Chromatic Visual Tests addon should be updated to 5.5.1 or later.