CVE-2026-114125

A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tricking the developer into interacting with an injected interface, attacker-controlled events can reach the active preview and modify story files, resulting in code execution with the developer's privileges.

Red Hat has rated this vulnerability as Important because an attacker can achieve arbitrary code execution under the privileges of the local user by manipulating cross-origin preview messaging. Successful exploitation requires strict preconditions, specifically that a Storybook development instance is running locally while the developer is enticed to visit and navigate an untrusted web page. Red Hat products package frontend components as static production assets rather than running interactive development servers, substantially limiting real-world exposure across enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.