{"items":[{"id":"NVI-00012099","kind":"vulnerability","title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","revision":5,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-f2ph-cmg5-wxc8","CVE-2026-114125"],"plain_summary":"GitHub lists this reviewed advisory for storybook, storybook, storybook, storybook, @storybook/core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-14284521285e9e6dec6139f6a99f91c5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.19 for storybook. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 9.1.21 for storybook. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 10.6.2 for storybook. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 11.0.0-alpha.6 for storybook. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.19 for @storybook/core. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.19 for @storybook/core-server. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.19 for @storybook/experimental-addon-test. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 9.1.21 for @storybook/addon-vitest. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 10.6.2 for @storybook/addon-vitest. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 11.0.0-alpha.6 for @storybook/addon-vitest. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 10.6.2 for @storybook/addon-mcp. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 11.0.0-alpha.6 for @storybook/addon-mcp. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-28T18:17:10.290Z","value":"8.6 HIGH (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-7a5cf7802d0245e7c3526d703f091db7"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.385%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.32607. Missing scores are unknown.","source_id":"sr-14284521285e9e6dec6139f6a99f91c5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a61fc8bb0235fa9a7d11ea9e62df8bd8","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f2ph-cmg5-wxc8","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:39.183Z"},{"id":"sr-712d6120a5dad10c1c9af116fa193678","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-f2ph-cmg5-wxc8","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-07T00:52:21.400Z"},{"id":"sr-7a5cf7802d0245e7c3526d703f091db7","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114125","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-114125","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:58:52.895Z"},{"id":"sr-14284521285e9e6dec6139f6a99f91c5","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-114125","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:44:07.776Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core-server","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/experimental-addon-test","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.6.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 8.0.0; fixed 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 9.0.0; fixed 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 10.0.0; fixed 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 11.0.0-alpha.0; fixed 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/core","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 8.0.0; fixed 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/core-server","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 8.0.0; fixed 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/experimental-addon-test","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 8.0.0; fixed 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 9.0.0; fixed 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 10.0.0; fixed 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 11.0.0-alpha.0; fixed 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 10.6.0; fixed 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 11.0.0-alpha.0; fixed 11.0.0-alpha.6"]}],"null_published_at":"2026-11-08T15:11:49.361Z","source_updated_at":"2026-10-21T17:23:30.000Z","source_disclosed_at":"2026-10-21T17:23:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T23:13:39.183Z"},{"id":"NVI-00012099","kind":"vulnerability","title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f2ph-cmg5-wxc8","CVE-2026-114125"],"plain_summary":"GitHub lists this reviewed advisory for storybook, storybook, storybook, storybook, @storybook/core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-14284521285e9e6dec6139f6a99f91c5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.19 for storybook. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 9.1.21 for storybook. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 10.6.2 for storybook. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 11.0.0-alpha.6 for storybook. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.19 for @storybook/core. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.19 for @storybook/core-server. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 8.6.19 for @storybook/experimental-addon-test. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 9.1.21 for @storybook/addon-vitest. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 10.6.2 for @storybook/addon-vitest. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 11.0.0-alpha.6 for @storybook/addon-vitest. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 10.6.2 for @storybook/addon-mcp. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 11.0.0-alpha.6 for @storybook/addon-mcp. Confirm the publisher’s latest guidance.","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.385%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.32607. Missing scores are unknown.","source_id":"sr-14284521285e9e6dec6139f6a99f91c5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a61fc8bb0235fa9a7d11ea9e62df8bd8","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f2ph-cmg5-wxc8","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:39.183Z"},{"id":"sr-712d6120a5dad10c1c9af116fa193678","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-f2ph-cmg5-wxc8","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-07T00:52:21.400Z"},{"id":"sr-14284521285e9e6dec6139f6a99f91c5","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-114125","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:44:07.776Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core-server","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/experimental-addon-test","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.6.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 8.0.0; fixed 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 9.0.0; fixed 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 10.0.0; fixed 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 11.0.0-alpha.0; fixed 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/core","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 8.0.0; fixed 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/core-server","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 8.0.0; fixed 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/experimental-addon-test","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 8.0.0; fixed 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 9.0.0; fixed 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 10.0.0; fixed 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 11.0.0-alpha.0; fixed 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 10.6.0; fixed 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-712d6120a5dad10c1c9af116fa193678"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":["SEMVER: introduced 11.0.0-alpha.0; fixed 11.0.0-alpha.6"]}],"null_published_at":"2026-11-07T00:57:04.326Z","source_updated_at":"2026-10-21T17:23:30.000Z","source_disclosed_at":"2026-10-21T17:23:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T23:13:39.183Z"},{"id":"NVI-00012099","kind":"vulnerability","title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f2ph-cmg5-wxc8","CVE-2026-114125"],"plain_summary":"GitHub lists this reviewed advisory for storybook, storybook, storybook, storybook, @storybook/core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-14284521285e9e6dec6139f6a99f91c5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.385%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.32607. Missing scores are unknown.","source_id":"sr-14284521285e9e6dec6139f6a99f91c5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a61fc8bb0235fa9a7d11ea9e62df8bd8","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f2ph-cmg5-wxc8","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:39.183Z"},{"id":"sr-14284521285e9e6dec6139f6a99f91c5","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-114125","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:44:07.776Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core-server","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/experimental-addon-test","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.6.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]}],"null_published_at":"2026-11-06T00:29:57.320Z","source_updated_at":"2026-10-21T17:23:30.000Z","source_disclosed_at":"2026-10-21T17:23:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T23:13:39.183Z"},{"id":"NVI-00012099","kind":"vulnerability","title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f2ph-cmg5-wxc8","CVE-2026-114125"],"plain_summary":"GitHub lists this reviewed advisory for storybook, storybook, storybook, storybook, @storybook/core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0d0624fe7187c6a1cc5514b7fcce2dc7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.385%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.3257. Missing scores are unknown.","source_id":"sr-0d0624fe7187c6a1cc5514b7fcce2dc7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a61fc8bb0235fa9a7d11ea9e62df8bd8","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f2ph-cmg5-wxc8","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:39.183Z"},{"id":"sr-0d0624fe7187c6a1cc5514b7fcce2dc7","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-114125","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:43.067Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core-server","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/experimental-addon-test","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.6.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]}],"null_published_at":"2026-11-01T14:34:14.097Z","source_updated_at":"2026-10-21T17:23:30.000Z","source_disclosed_at":"2026-10-21T17:23:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T23:13:39.183Z"},{"id":"NVI-00012099","kind":"vulnerability","title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f2ph-cmg5-wxc8","CVE-2026-114125"],"plain_summary":"GitHub lists this reviewed advisory for storybook, storybook, storybook, storybook, @storybook/core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a61fc8bb0235fa9a7d11ea9e62df8bd8","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f2ph-cmg5-wxc8","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:39.183Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"storybook","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/core-server","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/experimental-addon-test","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 8.0.0, < 8.6.19"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 9.0.0, < 9.1.21"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.0.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-vitest","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 10.6.0, < 10.6.2"]},{"certainty":"source_listed","source_ids":["sr-a61fc8bb0235fa9a7d11ea9e62df8bd8"],"technology":"@storybook/addon-mcp","known_exclusions":[],"conditions_summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.\n\n## Who is impacted?\n\nYou are impacted if you run a Storybook dev server in the affected versions.\n\nYou are not impacted if:\n\n- You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)\n- You run or visit a built version of Storybook\n\nRecent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.\n\n## Recommended actions\n\n### Upgrade Storybook\n\nStorybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. \n\nUpgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server unt","public_affected_ranges":[">= 11.0.0-alpha.0, < 11.0.0-alpha.6"]}],"null_published_at":"2026-11-01T01:03:56.630Z","source_updated_at":"2026-10-21T17:23:30.000Z","source_disclosed_at":"2026-10-21T17:23:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:39.183Z"}],"next_cursor":null,"snapshot_revision":"42594"}