CVE-2026-114125
- Source
- https://cve.org/CVERecord?id=CVE-2026-114125
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114125.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-114125
- Aliases
- Downstream
- Published
- 2026-10-21T17:08:12Z
- Modified
- 2026-10-22T02:49:12Z
- Severity
-
- 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
- Details
-
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1021", "CWE-346", "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114125.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114125.json
- https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
- https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
- https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0
- https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
- https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
- https://github.com/storybookjs/storybook/pull/36726
- https://github.com/storybookjs/storybook/releases/tag/v10.6.2
- https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
- https://github.com/storybookjs/storybook/releases/tag/v8.6.19
- https://github.com/storybookjs/storybook/releases/tag/v9.1.21
- https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8
- https://nvd.nist.gov/vuln/detail/CVE-2026-114125
Affected packages
Git / github.com/storybookjs/storybook
Affected ranges
- Type
- GIT
- Repo
- https://github.com/storybookjs/storybook
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "8.0.0" }, { "fixed": "8.6.19" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "9.0.0" }, { "fixed": "9.1.21" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "10.0.0" }, { "fixed": "10.6.2" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "11.0.0-alpha.0" }, { "fixed": "11.0.0-alpha.6" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "243c06bf8f1e2f09446c44868ea100261e1374da" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "3be03ec6f11f4616471cebc3fc65c13e1bf8c178" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "97513d999910d071c2b36830495dab63e17d9fe0" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "d9b09e332510a88689c71ecc081bbbc2d072476e" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "df3fed468c9b4830605f00068c4bc6b7e1e215ed" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v10.6.2", "range": [ { "fixed": "5f00d7d0a78e069aa304bdb886da923e012ef2e0" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v11.0.0-alpha.6", "range": [ { "fixed": "635ac8e2c2b0466ced380ef8a30344a3de48a32b" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v8.6.19", "range": [ { "fixed": "117b95a45b27138796c151b7928ba7956ca6da45" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v9.1.21", "range": [ { "fixed": "9abaf68f9a8dd45f0c861e9e1500ba1f6a850e0a" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v10.*
v10.0.0
v10.1.0
v10.1.0-alpha.0
v10.1.0-alpha.1
v10.1.0-alpha.10
v10.1.0-alpha.11
v10.1.0-alpha.12
v10.1.0-alpha.13
v10.1.0-alpha.14
v10.1.0-alpha.2
v10.1.0-alpha.3
v10.1.0-alpha.4
v10.1.0-alpha.5
v10.1.0-alpha.6
v10.1.0-alpha.7
v10.1.0-alpha.8
v10.1.0-alpha.9
v10.1.0-beta.0
v10.1.0-beta.1
v10.1.0-beta.2
v10.1.0-beta.3
v10.1.0-beta.4
v10.1.0-beta.5
v10.1.0-beta.6
v10.2.0
v10.2.0-alpha.0
v10.2.0-alpha.1
v10.2.0-alpha.10
v10.2.0-alpha.11
v10.2.0-alpha.12
v10.2.0-alpha.13
v10.2.0-alpha.14
v10.2.0-alpha.15
v10.2.0-alpha.16
v10.2.0-alpha.17
v10.2.0-alpha.18
v10.2.0-alpha.2
v10.2.0-alpha.3
v10.2.0-alpha.4
v10.2.0-alpha.5
v10.2.0-alpha.6
v10.2.0-alpha.7
v10.2.0-alpha.8
v10.2.0-alpha.9
v10.2.0-beta.0
v10.2.0-beta.1
v10.2.0-beta.2
v10.2.0-beta.3
v10.2.0-beta.4
v10.2.0-beta.5
v10.3.0
v10.3.0-alpha.0
v10.3.0-alpha.1
v10.3.0-alpha.10
v10.3.0-alpha.11
v10.3.0-alpha.12
v10.3.0-alpha.13
v10.3.0-alpha.14
v10.3.0-alpha.15
v10.3.0-alpha.16
v10.3.0-alpha.17
v10.3.0-alpha.2
v10.3.0-alpha.3
v10.3.0-alpha.4
v10.3.0-alpha.5
v10.3.0-alpha.6
v10.3.0-alpha.7
v10.3.0-alpha.8
v10.3.0-alpha.9
v10.3.0-beta.0
v10.3.0-beta.1
v10.3.0-beta.2
v10.3.0-beta.3
v10.4.0
v10.4.0-alpha.0
v10.4.0-alpha.1
v10.4.0-alpha.10
v10.4.0-alpha.11
v10.4.0-alpha.12
v10.4.0-alpha.13
v10.4.0-alpha.14
v10.4.0-alpha.15
v10.4.0-alpha.16
v10.4.0-alpha.17
v10.4.0-alpha.18
v10.4.0-alpha.19
v10.4.0-alpha.2
v10.4.0-alpha.3
v10.4.0-alpha.4
v10.4.0-alpha.5
v10.4.0-alpha.6
v10.4.0-alpha.7
v10.4.0-alpha.8
v10.4.0-alpha.9
v10.4.0-beta.0
v10.5.0
v10.5.0-alpha.0
v10.5.0-alpha.1
v10.5.0-alpha.10
v10.5.0-alpha.11
v10.5.0-alpha.2
v10.5.0-alpha.3
v10.5.0-alpha.4
v10.5.0-alpha.5
v10.5.0-alpha.6
v10.5.0-alpha.7
v10.5.0-alpha.8
v10.5.0-alpha.9
v10.5.0-beta.0
v10.5.0-beta.1
v10.5.0-beta.2
v10.6.0
v10.6.0-alpha.0
v10.6.0-alpha.1
v10.6.0-alpha.2
v10.6.0-alpha.3
v10.6.0-alpha.4
v10.6.0-alpha.5
v10.6.0-alpha.6
v10.6.0-alpha.7
v10.6.0-alpha.8
v10.6.0-alpha.9
v10.6.0-beta.0
v10.6.0-beta.1
v10.6.0-beta.2
v10.6.0-beta.3
v10.6.1
v11.*
v11.0.0-alpha.0
v11.0.0-alpha.1
v11.0.0-alpha.2
v11.0.0-alpha.3
v11.0.0-alpha.4
v11.0.0-alpha.5
v9.*
v9.0.0
v9.1.0
v9.1.0-alpha.0
v9.1.0-alpha.1
v9.1.0-alpha.10
v9.1.0-alpha.2
v9.1.0-alpha.3
v9.1.0-alpha.4
v9.1.0-alpha.5
v9.1.0-alpha.6
v9.1.0-alpha.7
v9.1.0-alpha.8
v9.1.0-alpha.9
v9.1.0-beta.0
v9.1.0-beta.1
v9.1.0-beta.2
v9.1.0-beta.3
v9.1.1
v9.1.10
v9.1.11
v9.1.12
v9.1.13
v9.1.14
v9.1.15
v9.1.16
v9.1.17
v9.1.18
v9.1.19
v9.1.2
v9.1.20
v9.1.3
v9.1.4
v9.1.5
v9.1.6
v9.1.7
v9.1.8
v9.1.9