CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

• CWE-94
• CWE-346
• CWE-1021

• https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
• https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
• https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0
• https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
• https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
• https://github.com/storybookjs/storybook/pull/36726
• https://github.com/storybookjs/storybook/releases/tag/v10.6.2
• https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
• https://github.com/storybookjs/storybook/releases/tag/v8.6.19
• https://github.com/storybookjs/storybook/releases/tag/v9.1.21
• https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8

Published

Oct 21, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11412A weakness has been identified in Jinher OA C6. The affected…6.3
• CVE-2026-114120SchedulePress before 5.3.5 contains a missing authorization …5.4
• CVE-2026-114121Electron is a framework for writing cross-platform desktop a…5.4
• CVE-2026-114122Electron is a framework for writing cross-platform desktop a…3.9
• CVE-2026-114123D365 F&O MCP Server is a Model Context Protocol server for q…7.5
• CVE-2026-114124Electron is a framework for writing cross-platform desktop a…3.9
• CVE-2026-114126Storybook is a frontend workshop for building user interface…8.7
• CVE-2026-114127Astro is a web framework for content-driven websites. From 7…2.3
• CVE-2026-114128Astro is a web framework for content-driven websites. Prior …6.5
• CVE-2026-114129stream-json is a micro-library of stream components for proc…6.2
• CVE-2026-11413A security vulnerability has been detected in JingDong JD Cl…8.8
• CVE-2026-114130Nuxt is an open-source web development framework for Vue.js.…2.3