EUVD-2026-107393
GHSA-f2ph-cmg5-wxc8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure developer to malicious site
-
DeliveryEmbed/message running Storybook preview
-
ExploitDeveloper interacts with injected UI
-
ExecutionInject code into story file
-
PersistLocal runtime executes modified file
-
ImpactArbitrary code execution as developer
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an affected Storybook development server (8.0.0-8.6.18, 9.0.0-9.1.20, 10.0.0-10.6.1, or 11.0.0-alpha.0-alpha.5) started via |
| Impact | This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/VC:H/VI:H/VA:H, base 8.6) rates it High, and CWE-94 (code injection) with full confidentiality/integrity/availability impact reflects the worst-case arbitrary code execution outcome. However, UI:A is decisive: the advisory and description both state a developer must actively visit an attacker-controlled site AND interact with an injected interface while an affected |
| Exploit ScenarioDerived | A developer running an affected Storybook dev server (e.g. on localhost:6006) visits a malicious website in the same browser. The site embeds or messages the Storybook preview and, because iframe embedding and postMessage origins are insufficiently restricted, delivers attacker-controlled events that the developer triggers by interacting with the injected UI, causing unauthorized edits to story files; if that modified file is subsequently executed by a local runtime, the attacker gains arbitrary code execution with the developer's privileges. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Cross-origin message injection in the Storybook preview iframe lets a malicious website drive a developer's locally running storybook dev server, sending attacker-controlled events into the preview that can rewrite story files in the project and, if a modified file is later executed by a local runtime, achieve arbitrary code execution with the developer's privileges. The flaw affects Storybook 8.0.0 through 8.6.18, 9.0.0 through 9.1.20, 10.0.0 through 10.6.1, and 11.0.0-alpha.0 through alpha.5; per the CVSS vector it is unauthenticated (PR:N) but requires user interaction (UI:A), since the developer must visit the attacker's site and engage with the injected interface in the same browser. Storybook states it is not aware of exploitation in the wild, and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 - Storybook shipped fixes across all affected major lines, and patched releases are available at the tagged GitHub releases (v8.6.19, v9.1.21, v10.6.2, v11.0.0-alpha.6) referenced from advisory GHSA-f2ph-cmg5-wxc8; the fix is also visible in PR https://github.com/storybookjs/storybook/pull/36726. If an immediate upgrade is impossible, the vendor's guidance is to stop running an affected storybook dev server until the fix is applied, since there is no configuration-only workaround in unpatched code; do not open untrusted websites in the same browser session as a live dev server, and decline any browser prompt asking a website to connect to a localhost service (a partial but non-complete mitigation in recent Chrome and Firefox). After upgrading, note the intentional behavioral change: storybook dev now sends Content-Security-Policy: frame-ancestors restricting embedding to Storybook itself and localhost/127.0.0.1, which breaks embedding over a LAN address, tunnel, or custom hostname - generate static output with storybook build instead, or set security.insecureRemoteIframeEmbed: true in .storybook/main to restore the old embedding (trade-off: any website the developer visits can then frame the local server). Similarly, cross-origin composition of live dev content now fails because preview messaging only trusts its own origin and a localhost manager; either compose a built Storybook or set security.insecureIframeMessaging: true in .storybook/main (trade-off: any embedding site can exchange messages with the Storybook). Enable these flags only as long as strictly necessary and revert them afterward, and use the final refs URL (not an http to https redirect target) when composing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Storybook's manager UI communicates with its preview via HTML5 postMessage inside an <iframe>, and neither side previously validated the origin of the sender or restricted who could embed the dev server. Because storybook dev serves the manager and preview on localhost without a Content-Security-Policy: frame-ancestors header on manager/preview responses, an arbitrary website could frame the developer's local Storybook and exchange messages with it, a classic missing-origin-validation pattern that maps to CWE-94 because the injected events ultimately give an attacker influence over generated or edited story source files. The attack chain is two-stage: first cross-origin control of the preview, then code execution only if a tampered story file is subsequently run by a local build/dev runtime. The fix adds frame-ancestors enforcement so only Storybook itself and pages on localhost/127.0.0.1 may embed a dev server, and makes both manager and preview accept messages only from their own preview iframes / own origin (and from a localhost manager), addressing replies to the expected origin instead of *. Built and published Storybook output is explicitly out of scope because the header and messaging restrictions apply only to storybook dev. Recent Chrome and Firefox localhost-access permission prompts partially mitigate the issue but do not eliminate it.
Know when Storybook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable via browser with no Storybook auth (PR:N), but a developer must visit a malicious site and interact (UI:R); impact is full code execution on the developer host (C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
Blast Radius
ecosystem impact- 9 npm packages depend on @storybook/core-server (6 direct, 3 indirect)
Ecosystem-wide dependent count for version 8.0.0.
Technical POC Analysis
Bug class is a chain, and the evidence is split on labeling.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Storybook's locally running development preview server (versions 8.x, 9.x, 10.x, and 11.0.0-alpha) can be manipulated by a malicious website a developer visits in the same browser, allowing attacker-controlled content to rewrite story files in the project and potentially execute code with the developer's own account privileges. Engineering workstations are the exposure point, and those machines typically hold repository credentials, cloud tokens, and access to internal source code, so a single successful interaction could escalate into broader codebase or supply-chain risk. Exploitation requires the developer to visit an attacker-controlled site and engage with the injected interface, and no public exploit or active exploitation has been identified, but no vendor patch is currently available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Cross-site WebSocket hijacking leading to persistent XSS and Remote Code Execution affects Storybook's dev server prior
Storybook's `storybook dev` server hands its WebSocket authentication token to any client that can load its HTML pages,
Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from `.env`
Exploit-DB