Storybook is a frontend workshop for building user interface components and pages in isolation.
CVE-2026-114125
Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) You run or visit a built version of Storybook Recent versions of Chrome and Firefox may ask for permission before a website can connect to a localhost service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust. Recommended actions Upgrade Storybook Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. Upgrade to a patched version listed below before running storybook dev again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.…
Part of the AI stack
This affects Model Context Protocol, in MCP & tool servers.
Assessment
- CVSS
- 9.4 (v4.0)
- Severity
- Critical
- EPSS
- 0.39% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 21 October 2026
- Last updated
- 28 October 2026
- Affected
- storybookjs · storybook · storybook · @storybook/core · @storybook/core-server · @storybook/experimental-addon-test
- Weakness
- CWE-1021, CWE-22, CWE-346, CWE-441, CWE-749, CWE-862, CWE-94, CWE-96
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
At the source
References
- https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
- https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
- https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0
- https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
- https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
- https://github.com/storybookjs/storybook/pull/36726
- https://github.com/storybookjs/storybook/releases/tag/v10.6.2
- https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
- https://github.com/storybookjs/storybook/releases/tag/v8.6.19
- https://github.com/storybookjs/storybook/releases/tag/v9.1.21
- https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8
- https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-114125