Storybook Patches Two Dev-Server Advisories Rated Critical and High, Changing Defaults in Versions 8 Through 11 Alpha

Overview

The Storybook project published two security advisories for its development server on October 12, 2026, and shipped patched releases for four version lines the same day. The project’s own advisories rate one critical and one high. The fixes are in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6, according to the critical advisory and the high-severity advisory. The 10.6.2 and 11.0.0-alpha.6 release notes each list the entry “Security: Patch GHSA-f2ph-cmg5-wxc8 and GHSA-px85-f4q5-jh77”.

What the Advisories Describe

The critical advisory, GHSA-f2ph-cmg5-wxc8, is titled “Storybook dev server preview allows code injection from malicious websites”. It carries a CVSS v4 score of 9.4. The project’s summary says that “A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running.” It adds that under additional conditions, “a changed file could be executed by a local runtime with the developer’s privileges.” The advisory states: “We are not aware of exploitation in the wild.”

Per the same advisory, the team received a responsible disclosure on September 30 showing how a malicious website can embed a dev server’s preview iframe and send events to the dev server. The team then combined that report with findings from an ongoing security audit. The advisory says the attack “relies on correctly exploiting a sequence of many vulnerabilities, some of which were never disclosed to the Storybook team,” and that the team has “not received evidence of exploitation in real Storybook projects.”

The high-severity advisory, GHSA-px85-f4q5-jh77, is titled “Storybook dev server vulnerable to code injection from the local network” and carries a CVSS v4 score of 8.7. According to the advisory, “The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages.” Any host on a local network can therefore obtain the token by opening the Storybook app by IP address. The advisory says the team received the disclosure on August 19, and that the impact is greater if the Vitest addon is installed alongside an old version of Vitest. Neither advisory page, as read on October 13, lists a CVE identifier.

Who Is Affected

Both advisories list the storybook package at 8.0.0 up to 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6. The advisories list @storybook/addon-vitest and @storybook/addon-mcp among the affected packages as well.

The critical advisory says users are not impacted if they run the dev server in an environment with restricted Internet access, such as agent containers, or if they only run or visit a built Storybook. It notes that recent versions of Chrome and Firefox “may ask for permission before a website can connect to a localhost service. This reduces the risk, but does not remove it.” The high-severity advisory says users are not impacted when connected to a trusted local network.

Default Behavior Changes

The critical advisory says the team chose to change defaults “including versions 8 and 9” for several network-related features. According to the two advisories, the changes are:

• Iframe embedding: the manager or preview can no longer be embedded in a page with a different host name when running the dev server. Built Storybooks are unaffected. The security.insecureRemoteIframeEmbed feature flag re-enables embedding from any origin.
• Cross-window messaging: in dev mode, Storybook accepts postMessage communication only with its own origin and other localhost services. A composed Storybook on a different origin now fails to load unless it has been built. The security.insecureIframeMessaging flag disables this protection, though the advisory recommends building composed Storybooks instead.
• Highlight event: the advisory says the highlight event API “was too permissive and could be used to trigger arbitrary events.” It was reworked, with no flag to restore the old form. Chromatic’s Visual Tests addon uses it, and the advisory says to update that addon to version 5.5.1 or later.
• Network binding: per the second advisory, the dev server now binds only to the loopback address 127.0.0.1. The advisory says a live dev server can be shared on a LAN with the --host option. Using --host 0.0.0.0 without core.allowedHosts disables host and origin validation, and Storybook then shows a warning and asks for confirmation.
• Vitest addon: it now disables browser.api.allowWrite and browser.api.allowExec, and the saveStoryRequest event validates input more strictly.

The 9.1.21 release notes list matching items, including “Block iframe embedding of the dev server from non-localhost origins”, “Add host validation warning and origin validation for MCP” and “Contain save story path to the project root”.

What Is Not Known

The advisories describe a worst case that depends on user interaction and on a local runtime executing a changed file. The sources read for this report give no count of affected installations. The statements that there is no evidence of exploitation are the project’s own, made in its advisories.

Teams that run storybook dev and cannot upgrade immediately are told in the critical advisory not to run an affected dev server until they can apply the fix.