{"id":"EUVD-2026-107393","enisaUuid":"9700d2c8-de0a-3c7b-a3b1-26469ee9f43f","description":"Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer\u0027s privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.","datePublished":"Oct 21, 2026, 5:08:12 PM","dateUpdated":"Oct 28, 2026, 5:13:06 PM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8\nhttps://github.com/storybookjs/storybook/pull/36726\nhttps://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da\nhttps://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178\nhttps://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0\nhttps://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e\nhttps://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed\nhttps://github.com/storybookjs/storybook/releases/tag/v10.6.2\nhttps://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6\nhttps://github.com/storybookjs/storybook/releases/tag/v8.6.19\nhttps://github.com/storybookjs/storybook/releases/tag/v9.1.21\n","aliases":"CVE-2026-114125\nGHSA-f2ph-cmg5-wxc8\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"129ffbb7-b461-3173-9b9c-6d4638a5a69b","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"8.0.0, \u003c 8.6.19"},{"id":"2d4c373b-bbb7-3864-bc46-9535782175ba","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"11.0.0-alpha.0, \u003c 11.0.0-alpha.6"},{"id":"aae22388-1926-354f-a6f4-c8447952dbe1","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"10.0.0, \u003c 10.6.2"},{"id":"b3f2b841-ceaa-3326-be53-7321b07552f6","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"9.0.0, \u003c 9.1.21"}],"enisaIdVendor":[{"id":"d47fba8d-2cfc-346e-89bd-a01928cc5581","vendor":{"name":"storybookjs"}}],"enisaIdVulnerability":[{"id":"0d1dbc53-89f0-3a05-a8ef-130ff04f3937","vulnerability":{"id":"CVE-2026-114125","description":"Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origin restrictions can allow attacker-controlled events to reach the running preview. A developer must visit the malicious website and interact with the injected interface. The attack can cause unauthorized changes to story files and, if a changed file is later executed by a local runtime, arbitrary code execution with the developer\u0027s privileges. This issue is fixed in 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.","datePublished":"Oct 21, 2026, 5:08:12 PM","dateUpdated":"Oct 28, 2026, 5:13:06 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8\nhttps://github.com/storybookjs/storybook/pull/36726\nhttps://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da\nhttps://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178\nhttps://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0\nhttps://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e\nhttps://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed\nhttps://github.com/storybookjs/storybook/releases/tag/v10.6.2\nhttps://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6\nhttps://github.com/storybookjs/storybook/releases/tag/v8.6.19\nhttps://github.com/storybookjs/storybook/releases/tag/v9.1.21\n","enisa_id":"EUVD-2026-107393\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 30, 2026, 3:00:56 AM","vulnerabilityProduct":[{"id":"70a812da-1128-3455-9680-ff794ea9e8d1","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"10.0.0, \u003c 10.6.2"},{"id":"74de6691-f038-3826-82fa-5fb50ef811a3","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"8.0.0, \u003c 8.6.19"},{"id":"86634458-64e0-3a28-91fd-147dd399aaff","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"9.0.0, \u003c 9.1.21"},{"id":"8f086a6d-1fbc-30bb-bee2-bad0c2248c37","product":{"name":"storybook","vendor":{"name":"storybookjs"}},"product_version":"11.0.0-alpha.0, \u003c 11.0.0-alpha.6"}],"vulnerabilityVendor":[{"id":"d13ed63a-58bc-3ce9-9b67-742565eb169b","vendor":{"name":"storybookjs"}}]}},{"id":"2aba217b-514f-3130-ae40-196df4577f5e","vulnerability":{"id":"GHSA-f2ph-cmg5-wxc8","description":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","datePublished":"Oct 21, 2026, 5:23:29 PM","dateUpdated":"Oct 21, 2026, 5:23:29 PM","baseScore":0.0,"references":"https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8\nhttps://github.com/storybookjs/storybook/pull/36726\nhttps://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da\nhttps://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178\nhttps://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb\nhttps://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e\nhttps://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed\nhttps://github.com/storybookjs/storybook\nhttps://github.com/storybookjs/storybook/releases/tag/v10.6.2\nhttps://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6\nhttps://github.com/storybookjs/storybook/releases/tag/v8.6.19\nhttps://github.com/storybookjs/storybook/releases/tag/v9.1.21\n","enisa_id":"EUVD-2026-107393\n","aliases":"GHSA-f2ph-cmg5-wxc8\nCVE-2026-114125\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"31e8a443-8a96-3382-baff-9a7f009018e2","advisory":{"id":"RHSA-2026:88541","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 23, 2026, 2:59:13 AM","dateUpdated":"Oct 23, 2026, 5:39:18 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88541\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88541.json\n","aliases":"CVE-2026-40895\nCVE-2026-111755\nCVE-2026-111756\nCVE-2026-114125\nCVE-2026-114126\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"12647ded-34be-3382-b4ea-96d80bc46606","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"1ba9a7b6-b93a-3827-8562-69c159281910","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"9a9b4d44-debf-39c6-afbd-db49c32117f1","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"a11f28bb-db66-3823-b996-24cea33e0f4e","product":{"name":"grafana13.2-0:13.2.4-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"a70351d2-2ed1-3591-a782-fce4c7f8bf32","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}}]}},{"id":"3cdbb649-2f3d-33d8-a572-ecf6bf525d5b","advisory":{"id":"RHSA-2026:88537","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 23, 2026, 2:44:52 AM","dateUpdated":"Oct 23, 2026, 5:39:12 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88537\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88537.json\n","aliases":"CVE-2026-111755\nCVE-2026-111756\nCVE-2026-114125\nCVE-2026-114126\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"808e1ae6-5952-3079-91e5-6e5e55907a8f","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"b0ac5b27-79e5-3098-bc9c-60a32f88ef3c","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"e2e46c28-81e5-3771-8615-39f32be989d2","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"e354f31d-4406-3112-8c80-7f6ebc8b6eb4","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"ee6c0769-6bbd-36a3-a31e-d4cf7d0068b6","product":{"name":"grafana13.1-0:13.1.8-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"aa6d7025-ca2e-3a1d-94c6-dc9fae0ee433","advisory":{"id":"RHSA-2026:88478","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 23, 2026, 1:10:24 AM","dateUpdated":"Oct 23, 2026, 5:39:12 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:88478\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88478.json\n","aliases":"CVE-2026-111755\nCVE-2026-111756\nCVE-2026-114125\nCVE-2026-114126\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"00b01034-98f9-3910-b49c-3b5736179aae","product":{"name":"grafana12.4-0:12.4.13-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"471e265c-9e89-3e31-85cd-919f8641339a","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"8b484f90-8a4e-3a2c-bcca-81ea341db71f","product":{"name":"grafana12.4-0:12.4.13-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"d98f79ac-2aea-31c6-aa4f-5e19eefb45fa","product":{"name":"grafana12.4-0:12.4.13-0.3.hum1@src","vendor":{"name":"Red Hat"}}}]}}]}