Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
影響: npm:storybook >= 8.0.0, < 8.6.19 → 8.6.19, npm:storybook >= 9.0.0, < 9.1.21 → 9.1.21, npm:storybook >= 10.0.0, < 10.6.2 → 10.6.2, npm:storybook >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/core >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/core-server >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/experimental-addon-test >= 8.0.0, < 8.6.19 → 8.6.19, npm:@storybook/addon-vitest >= 9.0.0, < 9.1.21 → 9.1.21, npm:@storybook/addon-vitest >= 10.0.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-vitest >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6, npm:@storybook/addon-mcp >= 10.6.0, < 10.6.2 → 10.6.2, npm:@storybook/addon-mcp >= 11.0.0-alpha.0, < 11.0.0-alpha.6 → 11.0.0-alpha.6
Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser…
| CVE | CVE-2026-114125 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/22 03:28 |
| データ | Markdown JSON |
2026/10/22 02:23、GitHub Advisory Databaseが「Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「緊急」(critical) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-114125。