CVE-2026-114125

A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected...

CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

CVE-2026-114125 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

CVE-2026-114125

Storybook versions prior to 8.6.19 , 9.1.21 , 10.6.2 , and 11.0.0-alpha.6 are vulnerable to code injection due to missing origin validation in the Storybook preview. Insufficient iframe embedding and message-origin restrictions allow a malicious website to interact with a running Storybook develo...