CVE-2026-114125: A malicious website can tamper with your project through a running Storybook dev server
While a vulnerable Storybook dev server is running and open in your browser, a malicious website can embed its preview and send events to it. With some user interaction this can change story files in your project, and if a changed file is later run, the attacker's code runs with your permissions. Storybook 8, 9, 10 and 11 alpha are affected, including @storybook/addon-mcp 10.6.x before 10.6.2. Patched in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6.
What it is
The dev server's preview iframe could be embedded by any website and accepted postMessage events from unknown origins, and the highlight event API was permissive enough to trigger arbitrary events, including ones the dev server processes.
Storybook's worst-case scenario chains these: an attacker-controlled page interacts with your running Storybook preview, causes unauthorized changes to story files with user interaction, and a local runtime later executes the changed file.
Storybook says it has seen no exploitation in real projects. Recent Chrome and Firefox versions may ask before a site can reach localhost, which lowers the risk but doesn't remove it.
How to check
- Affected: storybook and @storybook/core/@storybook/core-server 8.0.0 before 8.6.19, storybook 9.0.0 before 9.1.21, 10.0.0 before 10.6.2, 11.0.0-alpha.0 before 11.0.0-alpha.6; @storybook/addon-vitest and @storybook/experimental-addon-test in the same ranges; @storybook/addon-mcp 10.6.0 before 10.6.2 and 11.0.0-alpha.0 before alpha.6.
- You are only affected if you run storybook dev and open it in a browser. Built Storybooks and dev servers used only headlessly (for example by MCP clients) are not affected.
How to fix
- Upgrade to 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6 before running storybook dev again. If you can't, don't run an affected dev server.
- The fix changes defaults: cross-host iframe embedding of the dev server and messages from unknown origins are now blocked. Read the advisory before turning the new security.insecureRemoteIframeEmbed or security.insecureIframeMessaging flags back on.
- Don't grant localhost access to websites you don't trust when your browser asks.
npm ls storybook @storybook/core @storybook/addon-mcp @storybook/addon-vitest