CVE-2026-114125: CWE-94: Improper Control of Generation of Code ('Code Injection') in storybookjs storybook
Description
CVE-2026-114125 is a high-severity code injection vulnerability in Storybook, a frontend UI component development tool. Versions from 8.0.0 up to but not including 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6 are affected. The flaw allows a malicious website to interact with the preview iframe of a running Storybook development server due to insufficient iframe embedding and message-origin restrictions. An attacker can cause unauthorized changes to story files if a developer visits and interacts with the malicious site, potentially leading to arbitrary code execution with the developer's privileges. Fixes are available in versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
CVSS v4.0
Score 8.6high
Affected software
storybookjs
storybook
pkg:npm/storybookRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Storybook versions >=8.0.0 <8.6.19, >=9.0.0 <9.1.21, >=10.0.0 <10.6.2, and >=11.0.0-alpha.0 <11.0.0-alpha.6 contain a code injection vulnerability (CWE-94) due to insufficient iframe embedding and message-origin restrictions. This allows a malicious website to send attacker-controlled events to the Storybook preview iframe. If a developer visits and interacts with such a malicious site, the attacker can inject unauthorized changes into story files. When these altered files are later executed locally, arbitrary code execution can occur with the developer's privileges. The vulnerability is fixed in versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Potential Impact
An attacker can cause unauthorized modifications to Storybook story files by exploiting insufficient iframe and message-origin controls. This can lead to arbitrary code execution with the developer's privileges if the modified files are executed locally. The attack requires user interaction with a malicious website while the Storybook development server is running.
Mitigation Recommendations
This vulnerability is fixed in Storybook versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6. Users should upgrade to these or later versions to remediate the issue. No additional mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-20T21:53:58.472Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad8f70b4d27ba8daacf3529
Added to database: 10/21/2026, 17:31:55 UTC
Last enriched: 10/21/2026, 17:45:28 UTC
Last updated: 10/21/2026, 17:46:16 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.