CVE-2026-114125 storybookjs CVE debrief

Who should care

Developers using Storybook development servers, especially those who run the dev server and open it in a web browser, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-114125 is a vulnerability in Storybook that allows code injection from malicious websites, potentially leading to unauthorized file changes and execution of malicious code with developer privileges. Developers using affected Storybook versions should upgrade to patched versions and exercise caution when running dev servers.

• Code injection from malicious websites
• Unauthorized file changes in project files
• Potential execution of changed files with developer privileges
• Need for verification of project file integrity

Technical summary

The vulnerability is caused by missing origin validation in Storybook preview, allowing code injection from malicious websites. This can lead to unauthorized file changes in a developer’s project and potentially allow execution of changed files with the developer’s privileges. The vulnerability affects Storybook development servers, and developers using affected versions should upgrade to patched versions and exercise caution when running dev servers. The vulnerability has a high impact on the confidentiality, integrity, and availability of the affected systems.

Defensive priority

Upgrade to a patched version of Storybook before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server.

Recommended defensive actions

• Upgrade to a patched version of Storybook
• Do not run an affected Storybook dev server if immediate upgrade is not possible
• Verify the integrity of project files
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides details on the vulnerability and affected versions. However, the corpus does not provide information on exploitation in the wild or specific business impacts. The CVE record was published on 2026-10-21T17:23:29.000Z and has not been modified since then. The source item details are also provided, but they do not offer additional information on the vulnerability. The official CVE Program record and NIST NVD detail page provide further information on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.