https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-22T19:53:19.467769+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-114125 fkie_cve-2026-114125 2026-10-22T19:53:19.478501+00:00

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer's privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.

 https://db.gcve.eu/vuln/ghsa-f2ph-cmg5-wxc8 GHSA-f2ph-cmg5-wxc8 — Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites 2026-10-22T19:53:19.478619+00:00

Affected: npm: storybook, npm: @storybook/core, npm: @storybook/core-server, npm: @storybook/experimental-addon-test, npm: @storybook/addon-vitest, npm: @storybook/addon-mcp

**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.

## Who is impacted?

You are impacted if you run a Storybook dev server in the affected versions.

You are not impacted if:

- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook

Recent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.

## Recommended actions

### Upgrade Storybook

Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur.

Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.

- 11.0.0-alpha.6 - 10.6.2 - 9.1.21 - 8.6.19

### Review potentially breaking changes

Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network…