{"id":"ghsa-ghsa-f2ph-cmg5-wxc8","seq":32725,"kind":"advisory","title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f2ph-cmg5-wxc8","summary":"影響: npm:storybook >= 8.0.0, < 8.6.19 → 8.6.19, npm:storybook >= 9.0.0, < 9.1.21 → 9.1.21, npm:storybook >= 10.0.0, < 10.6.2 → 10.6.2, npm:storybook >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/core >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/core-server >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/experimental-addon-test >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/addon-vitest >= 9.0.0, < 9.1.21 → 9.1.21, npm:@storybook/addon-vitest >= 10.0.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-vitest >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/addon-mcp >= 10.6.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-mcp >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6\nSummary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser…","severity":"critical","techs":["nodejs"],"cves":["CVE-2026-114125"],"tags":["GHSA-f2ph-cmg5-wxc8","storybook","storybook","storybook","storybook","@storybook/core","@storybook/core-server","@storybook/experimental-addon-test","@storybook/addon-vitest","@storybook/addon-vitest","@storybook/addon-vitest","@storybook/addon-mcp","@storybook/addon-mcp"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T17:23:29.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}