AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by Storybook: Missing origin validation in Storybook preview allows code injection from…? What should I do?

    A malicious website could make unauthorized changes to files in a developer's project while an affected Storybook dev server is running.

    Affected: storybook >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6. Fixed in: 8.6.19. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/cve-2026-114125-storybook (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: storybook >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6. Fixed in: 8.6.19.

      • Check your version: run npm ls storybook. Versions >= 8.0.0, < 8.6.19 of storybook are affected.
      • Check your version: run npm ls @storybook/core. Versions >= 8.0.0, < 8.6.19 of @storybook/core are affected.
      • Check your version: run npm ls @storybook/core-server. Versions >= 8.0.0, < 8.6.19 of @storybook/core-server are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install storybook@8.6.19 (first patched version 8.6.19).
      2. Upgrade to the fixed version: run npm install @storybook/core@8.6.19 (first patched version 8.6.19).
      3. Upgrade to the fixed version: run npm install @storybook/core-server@8.6.19 (first patched version 8.6.19).
      4. Upgrade to a patched version (8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6) before running storybook dev again.
      5. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.
      6. Do not grant the localhost connection permission to websites you don't trust.
      7. If you embed a Storybook dev server through a separate web app, run that separate app on localhost.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-114125-storybook (opens external site)

      Did this work for you?

    Add your answer or comment