Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Date Oct 21, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product npm · storybook

CVE CVE-2026-114125

Critical vendor advisory CVE-2026-114125

Summary

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Why it matters

GitHub has published a reviewed security advisory for storybook. Prioritize it with other application dependency updates.

Operator check

Check whether storybook is present in application dependency manifests, lockfiles, or build images. Review the GitHub advisory and upgrade to a patched version where available. CVSS score: 9.4.

Sources

GitHub Advisory GHSA-f2ph-cmg5-wxc8 NVD — CVE-2026-114125 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed