Key points
- CVE-2026-114125 allows arbitrary code execution on developer machines running affected Storybook versions.
- The vulnerability requires a developer to visit a malicious website while their local dev server is active.
- Patched versions are available for Storybook 8, 9, 10, and 11 alpha branches.
A vulnerability in the Storybook frontend workshop allows attackers to execute arbitrary code on a developer's machine. The flaw, tracked as CVE-2026-114125, enables a malicious website to interact with the preview of a running Storybook development server. This interaction can lead to unauthorized changes to story files and subsequent code execution with the developer's privileges.
The issue stems from insufficient iframe embedding and message-origin restrictions in versions ranging from 8.0.0 up to specific patched releases. According to the National Vulnerability Database, the severity is rated high with a CVSS score of 8.6. The GitHub advisory describes the severity as critical. The attack vector requires the developer to visit a malicious site and interact with an injected interface.
What we know
The flaw affects Storybook versions 8.0.0 through 8.6.18, 9.0.0 through 9.1.20, 10.0.0 through 10.6.1, and 11.0.0-alpha.0 through 11.0.0-alpha.5. Multiple npm packages are impacted, including @storybook/core, @storybook/core-server, and several addons. The GitHub advisory states that the vendor is not aware of exploitation in the wild. Recent versions of Chrome and Firefox may prompt for permission before a website connects to a localhost service, which reduces but does not eliminate the risk.
Defender's checklist
- Verify if your team runs Storybook dev servers in any of the affected version ranges.
- Check whether developers have granted browser permissions to connect to localhost services from untrusted sites.
- Review network-related feature flags introduced in the patches to ensure compatibility with existing workflows.
- Confirm that headless automation or built versions of Storybook are not affected by this specific vulnerability.
What analysts watch for
Teams usually investigate how external sites interact with local development tools. Analysts examine iframe embedding policies and message-origin restrictions to understand how attacker-controlled events reach local previews. They check whether unauthorized file modifications occurred during development sessions. Investigators look for signs of arbitrary code execution triggered by local runtime processes. Security teams verify that browsers are properly restricting connections to localhost services from untrusted domains. They also assess whether developers visited suspicious websites while running vulnerable development servers.
What to do and how to stay safe
- Upgrade to the patched versions:
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
