Storybook Patches Dev-Server Vulnerabilities Enabling Browser-Based Code Injection

The Storybook project has disclosed a security advisory (GHSA-f2ph-cmg5-wxc8, CVE-2026-114125) describing missing origin validation in the Storybook preview that could allow a malicious website to interact with a running Storybook dev server. According to the advisory, a malicious site can embed the preview iframe and use postMessage to cause unauthorized file changes in a developer's project while the dev server is running; under additional conditions, a modified file could then be executed by a local runtime with the developer's privileges. The Storybook team states they are not aware of exploitation in the wild, and notes the worst-case scenario requires chaining several vulnerabilities, some never formally disclosed. Exploit status is listed as PoC-public.

Why It Matters

This affects anyone running the storybook dev server locally and opening it (or a page that embeds it) in a browser — a very common developer workflow. Affected packages include storybook, @storybook/core, @storybook/core-server, @storybook/experimental-addon-test, @storybook/addon-vitest, and @storybook/addon-mcp. Because the dev server runs with the developer's own privileges, successful exploitation could lead to code execution on a developer workstation — a potential foothold into source repositories, CI credentials, and internal networks. Headless/automated Storybook usage (e.g. MCP clients) and built/static Storybook deployments are reportedly not affected.

What Defenders Should Do Now

• Upgrade Storybook to the patched versions: 11.0.0-alpha.6, 10.6.2, 9.1.21, or 8.6.19. If you can't upgrade immediately, avoid running storybook dev until you can.
• Treat any browser tab with access to a localhost Storybook dev server as a trust boundary — don't grant browser prompts for permission to connect to localhost services from untrusted sites.
• Review whether your team relies on cross-origin iframe embedding or postMessage-based integrations with Storybook; the patch disables these by default behind feature flags (security.insecureRemoteIframeEmbed, security.insecureIframeMessaging), and re-enabling them restores risk.
• Hunt for unexpected modifications to story files or unexplained process execution correlated with developer machines running Storybook dev servers, especially where a browser was open to untrusted sites at the same time.
• If using Chromatic's Visual Tests addon alongside the accessibility addon's highlight event, update to 5.5.1+ since the event signature changed as part of this fix.

This is developing, same-day intel based on the vendor's own advisory; no in-the-wild exploitation has been confirmed. For full technical detail and the complete list of patched versions and feature flags, see the original Storybook advisory: GHSA-f2ph-cmg5-wxc8.