CVE-2026-114125

**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild. ## Who is impacted? You are impacted if you run a Storybook dev server in the affected versions. You are not impacted if: - You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients) - You run or visit a built version of Storybook Recent versions of Chrome and Firefox may ask for permission before a website can connect to a `localhost` service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust. ## Recommended actions ### Upgrade Storybook Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur. Upgrade to a patched version listed below before running `storybook dev` again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix. - 11.0.0-alpha.6 - 10.6.2 - 9.1.21 - 8.6.19 ### Review potentially breaking changes Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related features that are not essential to most Storybook users' workflow. If your team relies on the affected features, we've added feature flags that can disable specific security updates to support your existing workflows. Please carefully read the introduced flags and the consequences of using them. #### Iframe embedding over the network is disabled by default Storybook no longer allows the manager or preview to be embedded as an iframe on a website with a different host name. Built versi