CVE-2026-114125: storybook >= 8.0.0, < 8.6.19, >= 9.0.0, < 9.1.21, >= 10.0.0, < 10.6.2, >= 11.0.0-alpha.0, < 11.0.0-alpha.6

CVE-2026-114125 affects storybook. Affected range: >= 8.0.0, < 8.6.19. Fixed version: 8.6.19. Affected range: >= 9.0.0, < 9.1.21. Fixed version: 9.1.21. Affected range: >= 10.0.0, < 10.6.2. Fixed version: 10.6.2. Affected range: >= 11.0.0-alpha.0, < 11.0.0-alpha.6. Fixed version: 11.0.0-alpha.6. Affected range: >= 8.0.0, < 8.6.19. Fixed version: 8.6.19. Affected range: >= 8.0.0, < 8.6.19. Fixed version: 8.6.19. Affected range: >= 8.0.0, < 8.6.19. Fixed version: 8.6.19. Affected range: >= 9.0.0, < 9.1.21. Fixed version: 9.1.21. Affected range: >= 10.0.0, < 10.6.2. Fixed version: 10.6.2.

Affected technology

storybook · >= 8.0.0, < 8.6.19, >= 9.0.0, < 9.1.21, >= 10.0.0, < 10.6.2, >= 11.0.0-alpha.0, < 11.0.0-alpha.6
storybookjs

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

The source reports that an attacker could run attacker-chosen code under the conditions described by the source. Vendor/CNA’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality, integrity and availability impact as high.

Published 22-Oct-2026 01:10 UTC

CWE: CWE-94, CWE-346, CWE-1021
Product: storybook
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-22 02:21:33.599910+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-22 01:08:24.561609+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-114125.html