Storybook fixes dev server flaw that could lead to code execution

SecurityOnline[.]info reports that Storybook has fixed a critical dev server vulnerability, CVE-2026-114125, which the site rates at CVSS 9.4. The advisory states that under certain conditions a malicious website can interact with the preview of a running Storybook dev server and, with user interaction, may cause the dev server to make unauthorized changes to story files. If a local runtime subsequently runs a changed file, this can escalate to code execution with the developer’s privileges.

The disclosure followed a responsible report on 30 September and a broader audit by Storybook. At present, Storybook notes there is no confirmed exploitation in the wild and no public proof-of-concept has been verified, though the risk remains high due to the potential impact on local projects.

The affected releases include Storybook core components across multiple versions: storybook 8.0.0 to before 8.6.19, 9.0.0 to before 9.1.21, 10.0.0 to before 10.6.2, and 11.0.0-alpha.0 to before alpha.6; and @storybook/core, core-server and experimental-addon-test from 8.0.0 to before 8.6.19; with @storybook/addon-vitest and addon-mcp having corresponding upper bounds.

Patch and mitigation steps require upgrading to the fixed releases—Storybook 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6—or avoiding running an affected dev server if upgrade is not possible. Additional measures include denying localhost prompts from untrusted sites and updating Chromatic’s Visual Tests addon to 5.5.1 or later.

Storybook also notes that the defaults have changed, including blocking iframe embedding and rejecting postMessage traffic from unknown origins, with feature flags available to restore older behaviour but requiring caution. The article states the issue was resolved in the latest advisory, and advises reviewing the new defaults before re-enabling any previously disabled functionality.