Storybook dev server: malicious websites and LAN hosts can write story files, CVE-2026-114125 (9.4) and CVE-2026-114126; fixed 8.6.19, 9.1.21, 10.6.2

View raw markdownEdit on GitHub ↗

TL;DR

A running Storybook dev server let a website the developer visited embed its preview iframe and send it events, and let any host on the same LAN read the WebSocket token from its HTML; either path can write story files into the project and, under further conditions, run code with the developer's privileges. Storybook published two advisories on 2026-10-12 and shipped 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 the same day: CVE-2026-114125 (GHSA-f2ph-cmg5-wxc8, Critical, CVSS 4.0 9.4 on the vendor page, 8.6 on the CNA record) for the cross-origin path and CVE-2026-114126 (GHSA-px85-f4q5-jh77, High, 8.7) for the LAN path. The GitHub Advisory Database listed the first on 2026-10-21 and the reviewed-critical npm listing carried it with the @storybook/addon-mcp package first, which is how it surfaced here. The fixed versions bind to 127.0.0.1 by default, validate postMessage origins, restrict iframe embedding, and turn off the Vitest addon's allowWrite and allowExec. Built Storybooks and headless MCP use are not affected. The vendor reports no known exploitation.

What happened

CVE-2026-114125 / GHSA-f2ph-cmg5-wxc8. Published 2026-10-12 (reporter agent-killjoy, coordinator Sidnioulz, remediation ghengeveld). "A malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview." A developer must visit the site while the dev server runs; the events can change story files and, if a changed file is later executed by a local runtime, reach arbitrary code execution. CWE-22, CWE-94, CWE-96, CWE-346, CWE-441, CWE-749, CWE-862, CWE-1021. The vendor page prints CVSS 4.0 9.4 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H); the GitHub CNA record, published 2026-10-21, prints 8.6 with UI:A and no subsequent-system impact, same description. This file carries both readings with their dates. Affected and patched versions are in the frontmatter. Two feature flags re-enable the old behaviour, security.insecureRemoteIframeEmbed and security.insecureIframeMessaging; the advisory says to use them with caution, and composed Storybooks on different origins need the second one.

CVE-2026-114126 / GHSA-px85-f4q5-jh77. Published 2026-10-12 (reporters KimiSecurityTeam and christos-cantina-security; the disclosure reached Storybook on 2026-08-19). The dev server exposed its WebSocket authentication token to any client that could load its HTML, so any host on the LAN could open the app by IP, take the token, and use the WebSocket to inject code into story files or create files. Impact is greater with the Vitest addon on an old Vitest. CVSS 4.0 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), CWE-22, CWE-94, CWE-306, CWE-1188. Not affected: servers unreachable by other devices, trusted networks, static builds. The fix binds to 127.0.0.1 by default; --host <LAN IP> keeps host and origin validation; --host 0.0.0.0 requires core.allowedHosts or Storybook prompts for confirmation. The advisory also tells users to move Vite to 6.4.2, 7.3.2 or 8.0.5 and Vitest to 3.2.7 or 4.1.10.

Registry. npm time, read 2026-10-22: storybook 9.1.21 and 8.6.19 published 2026-10-12, 10.6.3 and 11.0.0-alpha.7 on 2026-10-20; @storybook/addon-mcp 11.0.0-alpha.6 and 10.6.2 on 2026-10-12, 10.6.3 on 10-20. The vendor tab also lists two older advisories not covered here: WebSocket hijacking (GHSA-mjf5-7g4m-gx5w, 2026-02-25) and .env exposure in published Storybooks (GHSA-8452-54wp-rmv6, 2025-12-17).

Why it is here: Storybook is the component workshop under most React and Vite front ends, it now ships an MCP addon so coding agents can drive it, and the bug class is the one this corpus keeps filing for Vite and Vitest: a dev server on a developer's machine that trusts the browser or the LAN, with a file-write primitive one step from code execution.

Am I affected?

  • npm ls storybook @storybook/addon-mcp @storybook/addon-vitest @storybook/core @storybook/core-server in each project. Affected ranges are in the frontmatter.
  • Exposure needs a running storybook dev. The cross-origin path needs the developer to visit a malicious page while it runs; the LAN path needs the server reachable from another device.
  • storybook build output, headless MCP clients, and Storybooks served as static files are not affected.
  • Check git status for story files you did not change and for new files under the stories directories; both advisories describe file writes as the first effect.

If you are affected

  1. Upgrade to 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6 before running storybook dev again; the vendor says not to run an affected dev server at all until then.
  2. Upgrade Vite and Vitest to the versions the second advisory names.
  3. Review the project's story files and recent commits for injected content. If the Vitest addon had allowExec on and a write occurred, treat the machine as having run attacker code: if your local AI agent was exploited covers the same credential set, then rotating cloud credentials.
  4. Do not set the two security.insecure* flags unless you need cross-origin composition, and then only on localhost.

Prevention

  • Agent sandboxing: dev servers an agent drives belong on loopback, inside a container, on a trusted network.
  • Credential hygiene: a developer machine holds the keys a file-write primitive reaches.

Sources