--- id: 2026-10-storybook-dev-server-cross-origin-preview-code-injection-cve-2026-114125-114126-addon-mcp title: "Storybook dev server: malicious websites and LAN hosts can write story files, CVE-2026-114125 (9.4) and CVE-2026-114126; fixed 8.6.19, 9.1.21, 10.6.2" date_disclosed: 2026-10-12 last_updated: 2026-10-22 severity: critical status: patched ecosystems: [npm, javascript, react, vite, frontend, local-dev, mcp] tools_affected: ["storybook 8.0.0 before 8.6.19, 9.0.0 before 9.1.21, 10.0.0 before 10.6.2, 11.0.0-alpha.0 before 11.0.0-alpha.6", "@storybook/addon-mcp 10.6.0 before 10.6.2 and 11.0.0-alpha.0 before 11.0.0-alpha.6", "@storybook/addon-vitest, @storybook/core, @storybook/core-server, @storybook/experimental-addon-test in the same ranges", "any developer running `storybook dev` while browsing, or on an untrusted network"] tags: [cve, ghsa, storybook, dev-server, cross-origin, postmessage, origin-validation, websocket-token, code-injection, local-dev-rce, react, vite, vitest, mcp-addon, db-date-lag] --- ## TL;DR A running Storybook dev server let a website the developer visited embed its preview iframe and send it events, and let any host on the same LAN read the WebSocket token from its HTML; either path can write story files into the project and, under further conditions, run code with the developer's privileges. Storybook published two advisories on 2026-10-12 and shipped 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 the same day: CVE-2026-114125 (GHSA-f2ph-cmg5-wxc8, Critical, CVSS 4.0 9.4 on the vendor page, 8.6 on the CNA record) for the cross-origin path and CVE-2026-114126 (GHSA-px85-f4q5-jh77, High, 8.7) for the LAN path. The GitHub Advisory Database listed the first on 2026-10-21 and the reviewed-critical npm listing carried it with the `@storybook/addon-mcp` package first, which is how it surfaced here. The fixed versions bind to `127.0.0.1` by default, validate `postMessage` origins, restrict iframe embedding, and turn off the Vitest addon's `allowWrite` and `allowExec`. Built Storybooks and headless MCP use are not affected. The vendor reports no known exploitation. ## What happened **CVE-2026-114125 / GHSA-f2ph-cmg5-wxc8.** Published 2026-10-12 (reporter agent-killjoy, coordinator Sidnioulz, remediation ghengeveld). "A malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview." A developer must visit the site while the dev server runs; the events can change story files and, if a changed file is later executed by a local runtime, reach arbitrary code execution. CWE-22, CWE-94, CWE-96, CWE-346, CWE-441, CWE-749, CWE-862, CWE-1021. The vendor page prints CVSS 4.0 9.4 (`AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`); the GitHub CNA record, published 2026-10-21, prints 8.6 with `UI:A` and no subsequent-system impact, same description. This file carries both readings with their dates. Affected and patched versions are in the frontmatter. Two feature flags re-enable the old behaviour, `security.insecureRemoteIframeEmbed` and `security.insecureIframeMessaging`; the advisory says to use them with caution, and composed Storybooks on different origins need the second one. **CVE-2026-114126 / GHSA-px85-f4q5-jh77.** Published 2026-10-12 (reporters KimiSecurityTeam and christos-cantina-security; the disclosure reached Storybook on 2026-08-19). The dev server exposed its WebSocket authentication token to any client that could load its HTML, so any host on the LAN could open the app by IP, take the token, and use the WebSocket to inject code into story files or create files. Impact is greater with the Vitest addon on an old Vitest. CVSS 4.0 8.7 (`AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H`), CWE-22, CWE-94, CWE-306, CWE-1188. Not affected: servers unreachable by other devices, trusted networks, static builds. The fix binds to `127.0.0.1` by default; `--host ` keeps host and origin validation; `--host 0.0.0.0` requires `core.allowedHosts` or Storybook prompts for confirmation. The advisory also tells users to move Vite to 6.4.2, 7.3.2 or 8.0.5 and Vitest to 3.2.7 or 4.1.10. **Registry.** npm `time`, read 2026-10-22: `storybook` 9.1.21 and 8.6.19 published 2026-10-12, 10.6.3 and 11.0.0-alpha.7 on 2026-10-20; `@storybook/addon-mcp` 11.0.0-alpha.6 and 10.6.2 on 2026-10-12, 10.6.3 on 10-20. The vendor tab also lists two older advisories not covered here: WebSocket hijacking (GHSA-mjf5-7g4m-gx5w, 2026-02-25) and `.env` exposure in published Storybooks (GHSA-8452-54wp-rmv6, 2025-12-17). Why it is here: Storybook is the component workshop under most React and Vite front ends, it now ships an MCP addon so coding agents can drive it, and the bug class is the one this corpus keeps filing for Vite and Vitest: a dev server on a developer's machine that trusts the browser or the LAN, with a file-write primitive one step from code execution. ## Am I affected? - `npm ls storybook @storybook/addon-mcp @storybook/addon-vitest @storybook/core @storybook/core-server` in each project. Affected ranges are in the frontmatter. - Exposure needs a running `storybook dev`. The cross-origin path needs the developer to visit a malicious page while it runs; the LAN path needs the server reachable from another device. - `storybook build` output, headless MCP clients, and Storybooks served as static files are not affected. - Check `git status` for story files you did not change and for new files under the stories directories; both advisories describe file writes as the first effect. ## If you are affected 1. Upgrade to 8.6.19, 9.1.21, 10.6.2 or 11.0.0-alpha.6 before running `storybook dev` again; the vendor says not to run an affected dev server at all until then. 2. Upgrade Vite and Vitest to the versions the second advisory names. 3. Review the project's story files and recent commits for injected content. If the Vitest addon had `allowExec` on and a write occurred, treat the machine as having run attacker code: [if your local AI agent was exploited](../playbooks/if-your-local-ai-agent-was-exploited.md) covers the same credential set, then [rotating cloud credentials](../playbooks/rotating-cloud-credentials.md). 4. Do not set the two `security.insecure*` flags unless you need cross-origin composition, and then only on `localhost`. ## Prevention - [Agent sandboxing](../prevention/agent-sandboxing.md): dev servers an agent drives belong on loopback, inside a container, on a trusted network. - [Credential hygiene](../prevention/credential-hygiene.md): a developer machine holds the keys a file-write primitive reaches. ## Sources - [storybookjs/storybook — GHSA-f2ph-cmg5-wxc8: Missing origin validation in Storybook preview allows code injection from malicious websites](https://github.com/advisories/GHSA-f2ph-cmg5-wxc8) — fetched 2026-10-22: published 2026-10-12, CVSS 9.4 and vector, the affected and patched table, the quoted description, workarounds, feature flags, CWEs, references to PR #36726 and the four release tags, credits. - [storybookjs/storybook — GHSA-px85-f4q5-jh77: Storybook dev server vulnerable to code injection from the local network](https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77) — fetched 2026-10-22: CVE-2026-114126, published 2026-10-12, CVSS 8.7 and vector, the token-exposure mechanism, the 2026-08-19 report date, the loopback default and `--host` behaviour, the Vite and Vitest version advice, credits. - [CVE Services — CVE-2026-114125](https://cveawg.mitre.org/api/cve/CVE-2026-114125) — fetched 2026-10-22: GitHub CNA, published 2026-10-21, CVSS 4.0 8.6 and vector, the four affected ranges, references. - [storybookjs/storybook — security advisories tab](https://github.com/storybookjs/storybook/security/advisories) — fetched 2026-10-22: four advisories, the two above dated 2026-10-12. - [GitHub Advisory Database — `mcp` listing sorted by published date](https://github.com/advisories?query=mcp+sort%3Apublished-desc) and [reviewed critical npm listing](https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm+severity%3Acritical+sort%3Apublished-desc) — fetched 2026-10-22: GHSA-f2ph-cmg5-wxc8 dated 2026-10-21 with `@storybook/addon-mcp` as the first package. - npm registry `time` for `storybook` and `@storybook/addon-mcp` — read 2026-10-22: the publish dates above. - Related in this corpus: [Vitest browser-mode CDP RCE](2026-07-vitest-browser-mode-cdp-rce.md), [Vitest 5 dev-server file exposure and mocker injection](2026-10-vitest-5-dev-server-fs-deny-misapplied-mocker-code-injection-cve-2026-112948-112949-112950.md).