## Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

- 種別: advisory
- 重大度: critical
- 関連技術: nodejs
- CVE: CVE-2026-114125
- 公開日時: 2026-10-21T17:23:29.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-f2ph-cmg5-wxc8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-f2ph-cmg5-wxc8

影響: npm:storybook >= 8.0.0, < 8.6.19 → 8.6.19, npm:storybook >= 9.0.0, < 9.1.21 → 9.1.21, npm:storybook >= 10.0.0, < 10.6.2 → 10.6.2, npm:storybook >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/core >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/core-server >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/experimental-addon-test >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/addon-vitest >= 9.0.0, < 9.1.21 → 9.1.21, npm:@storybook/addon-vitest >= 10.0.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-vitest >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/addon-mcp >= 10.6.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-mcp >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6
Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser…