Storybook dev server bugs let a malicious website or a device on the same network write code into story files

Two CVE records for the Storybook development server were published October 21, 2026, both from GitHub, both covering storybook >=8.0.0 <8.6.19, >=9.0.0 <9.1.21, >=10.0.0 <10.6.2, and >=11.0.0-alpha.0 <11.0.0-alpha.6, and both fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

CVE-2026-114125 says a malicious website can interact with the preview of a running Storybook dev server because of insufficient iframe embedding and message-origin restrictions. The developer has to visit the site and interact with the injected interface. The attack can change story files, and if a changed file is later executed by a local runtime, run code with the developer's privileges. The record scores it CVSS 4.0 8.6 High. Storybook's advisory, GHSA-f2ph-cmg5-wxc8, rates it Critical 9.4, says a dev server never opened in a browser and a built Storybook are not affected, and says Storybook is not aware of exploitation in the wild. It notes that recent Chrome and Firefox versions may ask before a website connects to a localhost service, which reduces the risk but does not remove it.

CVE-2026-114126 says the dev server can expose its WebSocket authentication token to anyone on the local network who can load its pages. With the token, an attacker can use the dev server's file-writing and testing functions to place code in story files, and if the Vitest addon is installed with an old Vitest, write more files or run commands. The record scores it CVSS 4.0 8.7 High. The advisory, GHSA-px85-f4q5-jh77, says you are not affected on a trusted network or when other devices cannot reach the Storybook port. It also recommends upgrading Vite to 6.4.2, 7.3.2, or 8.0.5 and Vitest to 3.2.7 or 4.1.10. The affected package list in both advisories includes @storybook/addon-mcp 10.6.0 and 10.6.1.

Storybook published the fixes on October 12, 2026 and changed some defaults. The dev server now listens only on 127.0.0.1 by default. Iframe embedding from non-localhost origins is blocked by default, while localhost integrations remain supported. In dev mode, the preview and manager accept messages only from their own origin and other localhost services. The Vitest addon disables Vitest's browser write and exec APIs. Built Storybooks remain embeddable and continue to accept messages from unknown origins.