CVE-2026-114125: 
JavaScript vulnerability analysis and mitigation

CVE-2026-114125 is a missing origin validation vulnerability in the Storybook development server that allows a malicious website to interact with a running Storybook preview and potentially inject code into story files. Affecting Storybook versions 8.0.0 through 8.6.18, 9.0.0 through 9.1.20, 10.0.0 through 10.6.1, and 11.0.0-alpha.0 through 11.0.0-alpha.5, the flaw was responsibly disclosed on September 30, 2026, and patched versions were published on October 12, 2026, with the advisory formally published on October 21, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory).

The root cause is a combination of insufficient iframe embedding restrictions and missing postMessage origin validation (CWE-346, CWE-1021), compounded by an exposed dangerous file-write API (CWE-749, CWE-862) and path traversal weaknesses (CWE-22) in the dev server's save-story functionality. A malicious website can embed the Storybook preview iframe or send crafted postMessage events to the running dev server, which does not verify the origin of incoming messages in affected versions. With user interaction — specifically, a developer visiting the attacker's page while a Storybook dev server is running — the attacker can trigger events that cause the dev server to write attacker-controlled content to story files on disk (CWE-96, static code injection). If the modified file is subsequently executed by a local runtime (e.g., Node.js test runner), arbitrary code execution with the developer's OS privileges results (GitHub Advisory, Patch PR).

Successful exploitation can lead to unauthorized modification of source files in a developer's project and, under the worst-case scenario, arbitrary code execution with the developer's local privileges if a modified file is later run by a local runtime. The confidentiality, integrity, and availability of the developer's workstation and project are all at high risk — an attacker could exfiltrate source code, inject backdoors into the codebase, or corrupt project files. Because the attack targets the developer's local machine rather than a production server, the blast radius is scoped to the individual developer's environment, but supply-chain implications exist if malicious code is committed and distributed (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the advisory publication date (GitHub Advisory). The EPSS score is 0.0, reflecting the currently low probability of automated exploitation. The attack requires user interaction — a developer must visit a malicious website while their Storybook dev server is running — and recent versions of Chrome and Firefox may prompt for permission before allowing a website to connect to localhost services, providing a partial mitigation. No threat actor attribution or CISA KEV catalog listing has been identified for this vulnerability.

1. Setup malicious website: The attacker creates a web page that embeds the target developer's Storybook preview URL (e.g., http://localhost:6006/iframe.html) in an iframe, or crafts JavaScript to send postMessage events directly to the Storybook preview origin.
2. Lure the developer: The attacker tricks the developer into visiting the malicious website while a Storybook dev server is running on their machine (e.g., via phishing, malicious ad, or compromised dependency documentation).
3. Bypass browser prompts: If the browser (Chrome/Firefox) prompts for permission to connect to localhost, the attacker's page uses social engineering to convince the developer to grant it.
4. Send malicious postMessage events: The attacker's page sends crafted postMessage events to the embedded Storybook preview iframe, exploiting the lack of origin validation to reach the dev server's event channel.
5. Trigger unauthorized file write: The attacker crafts events that invoke the dev server's save-story or file-write API, injecting malicious code into a story file within the developer's project (exploiting path traversal and static code injection weaknesses).
6. Achieve code execution: When the developer (or an automated process such as a test runner or hot-reload) executes the modified story file, the injected code runs with the developer's local OS privileges, enabling data exfiltration, persistence, or further lateral movement (GitHub Advisory, Patch PR).

• File System: Unexpected or recently modified .stories.js/.stories.ts/.stories.tsx files in the project directory with unfamiliar content, especially containing eval(), require(), child_process, or network calls.
• File System: New or modified files in the Storybook project root that do not correspond to developer activity (check git diff or file modification timestamps).
• Logs: Storybook dev server logs showing unexpected save-story or file-write events, particularly from origins other than localhost.
• Network: Browser developer tools or proxy logs showing postMessage traffic from an external origin to localhost:6006 (or the configured Storybook port), or unexpected outbound connections from the Node.js process.
• Process: Unusual child processes spawned by the Node.js/Storybook dev server process (e.g., sh, bash, curl, wget, python) that are not part of normal development workflow.

Upgrade Storybook to a patched version immediately before running storybook dev again: 8.6.19, 9.1.21, 10.6.2, or 11.0.0-alpha.6 (GitHub Advisory). If an immediate upgrade is not possible, do not run an affected Storybook dev server. When prompted by Chrome or Firefox for permission to allow a website to connect to localhost services, deny the request for untrusted sites. The patched versions enforce strict iframe embedding restrictions (disabling remote iframe embedding by default), validate postMessage origins, restrict the highlight event API, and add origin/content-type validation to MCP endpoints; feature flags (security.insecureRemoteIframeEmbed, security.insecureIframeMessaging) are available for teams that require legacy behavior (Patch PR).

The Storybook team issued a detailed security advisory noting that the attack was responsibly disclosed on September 30, 2026, and that they combined the disclosure with findings from an ongoing security audit to address the full worst-case exploitation chain (GitHub Advisory). The team emphasized that no exploitation in real Storybook projects has been observed and that the attack requires correctly exploiting a sequence of multiple vulnerabilities. Red Hat also tracked the vulnerability via their Bugzilla system, indicating broader ecosystem awareness.