Description
Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.
Recommendation
Update the storybook package to the latest compatible version. Followings are version details:
Affected version(s): **>= 11.0.0-alpha.0, < 11.0.0-alpha.6 >= 10.0.0, < 10.6.2 >= 9.0.0, < 9.1.21 >= 8.0.0, < 8.6.19** Patched version(s): **11.0.0-alpha.6 10.6.2 9.1.21 8.6.19**
References
Could your website be exposed too?
SmartScanner can check your website for Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Storybook dev server vulnerable to code injection from the local network - CVE-2026-114126
- Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex - CVE-2026-45395
- locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor - CVE-2026-41886
- Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage - CVE-2026-53728
You might also like:
See something that needs correcting? Let us knowUpdated October 21, 2026