https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 19:53:20 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114125 <p>Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer&#39;s privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.</p> <p>Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer&#39;s privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114125 https://db.gcve.eu/vuln/ghsa-f2ph-cmg5-wxc8 <p><strong>Affected:</strong> npm: storybook, npm: @storybook/core, npm: @storybook/core-server, npm: @storybook/experimental-addon-test, npm: @storybook/addon-vitest, npm: @storybook/addon-mcp</p> <p>**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.</p> <p>## Who is impacted?</p> <p>You are impacted if you run a Storybook dev server in the affected versions.</p> <p>You are not impacted if:</p> <p>- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook</p> <p>Recent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.</p> <p>## Recommended actions</p> <p>### Upgrade Storybook</p> <p>Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur.</p> <p>Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.</p> <p>- 11.0.0-alpha.6 - 10.6.2 - 9.1.21 - 8.6.19</p> <p>### Review potentially breaking changes</p> <p>Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network…</p> <p><strong>Affected:</strong> npm: storybook, npm: @storybook/core, npm: @storybook/core-server, npm: @storybook/experimental-addon-test, npm: @storybook/addon-vitest, npm: @storybook/addon-mcp</p> <p>**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.</p> <p>## Who is impacted?</p> <p>You are impacted if you run a Storybook dev server in the affected versions.</p> <p>You are not impacted if:</p> <p>- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook</p> <p>Recent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.</p> <p>## Recommended actions</p> <p>### Upgrade Storybook</p> <p>Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur.</p> <p>Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.</p> <p>- 11.0.0-alpha.6 - 10.6.2 - 9.1.21 - 8.6.19</p> <p>### Review potentially breaking changes</p> <p>Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network…</p> https://db.gcve.eu/vuln/ghsa-f2ph-cmg5-wxc8