Critical (AgentArmorHQ estimate)Code executionOctober 21, 2026

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Product: Storybook
CVE: CVE-2026-114125
Affected: storybook >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6
Fixed in: 8.6.19

Last verified against sources: October 26, 2026

Am I affected?

Storybook: affected storybook >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6. Fixed in 8.6.19.

Check your version: run npm ls storybook. Versions >= 8.0.0, < 8.6.19 of storybook are affected. [1]
Check your version: run npm ls @storybook/core. Versions >= 8.0.0, < 8.6.19 of @storybook/core are affected. [1]
Check your version: run npm ls @storybook/core-server. Versions >= 8.0.0, < 8.6.19 of @storybook/core-server are affected. [1]

What to do now

Upgrade to the fixed version: run npm install storybook@8.6.19 (first patched version 8.6.19). [1]
Upgrade to the fixed version: run npm install @storybook/core@8.6.19 (first patched version 8.6.19). [1]
Upgrade to the fixed version: run npm install @storybook/core-server@8.6.19 (first patched version 8.6.19). [1]
Upgrade to a patched version (8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6) before running storybook dev again. [1]
If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix. [1]
Do not grant the localhost connection permission to websites you don't trust. [1]
If you embed a Storybook dev server through a separate web app, run that separate app on localhost. [1]

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

Discuss this incident

What happened

A malicious website could make unauthorized changes to files in a developer's project while an affected Storybook dev server is running. [1]
The cause is missing origin validation in the Storybook preview. [1]
The Storybook team received a responsible disclosure on September 30th. [1]

Impact

A changed file could be run by a local runtime with the developer's permissions. [1]
The worst case could lead to arbitrary code execution with the developer's permissions. [1]
The Storybook team says it is not aware of exploitation in the wild. [1]

What was done

Storybook released patched versions for all affected major versions. [1]
The team changed the default behavior of several network-related features in versions 8 and 9. [1]
The team reworked the highlight event API to prevent abuse. [1]
The team added feature flags that can turn off specific security updates. [1]

Sources

GHSA-f2ph-cmg5-wxc8 — GitHub Advisory Database

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.

Copy a plain-text summary for Slack, GitHub issues, or team security channels.

Brief

[CVE-2026-114125] Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Product: Storybook | Affected: storybook >= 8.0.0, < 8.6.19; >= 9.0.0, < 9.1.21; >= 10.0.0, < 10.6.2; >= 11.0.0-alpha.0, < 11.0.0-alpha.6 | Fixed in: 8.6.19
Summary: A malicious website could make unauthorized changes to files in a developer's project while an affected Storybook dev server is running.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-114125-storybook

Was this page useful?

Corrections

Report an error or request a correction. We review requests within 5 business days and add a dated correction note.

Discussions for CVE-2026-114125

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

← All incidents Related tools in directory Check package