CVE-2026-114125highCWE-1021CWE-346CWE-94

CVE-2026-114125: falha de alta gravidade em storybookjs storybook

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar storybook+ Monitorar storybook

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.4%
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
storybookjs · storybook
CVEs relacionadas — storybookjs storybook

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27148HIGHStorybook Dev Server Vulnerable to WebSocket HijackingEPSS 0.6%CVE-2026-114126HIGHStorybook dev server: devices on the same network can obtain the WebSocket token and write code into story filesEPSS 0.5%CVE-2025-68429HIGHStorybook manager bundle may expose environment variables during buildEPSS 0.3%