Threats tagged 'ghsa-f2ph-cmg5-wxc8'

CVE-2026-114125 is a code injection vulnerability in Storybook, a frontend UI component development tool. Versions from 8.0.0 up to but not including 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6 are affected. The flaw allows a malicious website to interact with the preview iframe of a running Storybook development server due to insufficient iframe embedding and message-origin restrictions. An attacker can cause unauthorized changes to story files if a developer visits and interacts with the malicious site, potentially leading to arbitrary code execution with the developer's privileges when the modified files are executed locally. Fixed versions include 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.