Storybook: Missing origin validation in preview allows code injection
Summary
Storybook development server previews from versions 8.0.0 up to 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6 do not sufficiently restrict embedding and message origins. A malicious website can send attacker-controlled events to the running preview. If a developer visits such a website and interacts with the injected interface, an attacker can make unauthorized changes to story files. If a changed file is later executed by a local runtime, arbitrary code runs with the developer's privileges.
Affected
- Storybook 8.0.0 to before 8.6.19
- Storybook 9.0.0 to before 9.1.21
- Storybook 10.0.0 to before 10.6.2
- Storybook 11.0.0-alpha.0 to before 11.0.0-alpha.6
Fixed in
- Storybook 8.6.19
- Storybook 9.1.21
- Storybook 10.6.2
- Storybook 11.0.0-alpha.6
Workaround
Unknown.
Exploitation
- CISA SSVC: Exploitation none, automatable no, technical impact total
- No known exploitation reported at the time of analysis
- Requires user interaction: a developer must visit a malicious website and interact with the injected interface
Our recommendation
- Upgrade Storybook development dependencies to a fixed version listed above
- Until patched, do not visit untrusted websites while a Storybook dev server is running
- Review story files for unexpected changes, especially files modified recently
- Do not run Storybook dev servers on shared or untrusted networks
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-f2ph-cmg5-wxc8 github.com
- Storybook release v8.6.19 github.com
- Storybook release v9.1.21 github.com
- Storybook release v10.6.2 github.com
- Storybook release v11.0.0-alpha.6 github.com
- Storybook pull request #36726 github.com
- Storybook security documentation storybook.js.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:22.
Original description (NVD)
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
NVD references (11)
- https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
- https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
- https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0
- https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
- https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
- https://github.com/storybookjs/storybook/pull/36726
- https://github.com/storybookjs/storybook/releases/tag/v10.6.2
- https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
- https://github.com/storybookjs/storybook/releases/tag/v8.6.19
- https://github.com/storybookjs/storybook/releases/tag/v9.1.21
- https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.