What is the CVSS score of CVE-2025-68429?

CVE-2025-68429 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-68429?

Within 24 hours: Audit all published Storybook instances for sensitive data exposure by reviewing build artifacts in `.storybook/dist` or equivalent output directories; immediately remove any exposed credentials from production. Within 7 days: Identify all projects running Storybook 7.0.0-10.1.9; move `.env` files outside the Storybook build directory or use environment-specific configuration files that exclude secrets. Within 30 days: Implement a pre-build validation step to detect `.env` file presence in build paths; monitor vendor advisories for patch release and upgrade to patched version immediately upon availability; configure CI/CD to fail builds if environment variables are detected in bundle output.

Storybook CVE-2025-68429

HIGH

Information Exposure (CWE-200)

2025-12-17 security-advisories@github.com

Information Disclosure Red Hat Storybook

7.3

CVSS 3.1 · GitHub Advisory

View

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	Unauthenticated network-accessible disclosure of environment variables in published Storybook bundles. High impact for projects storing secrets in `.env` files during build, but requires specific conditions: `.env` file presence at build time and web publication. Exposure severity depends on secret type and repository structure. Many CI workflows unaffected due to platform-provided environment variables.
Exploit ScenarioDerived	Attacker accesses published Storybook bundle source code (viewable in browser), extracts exposed environment variables from bundled artifacts. No authentication required; discovery occurs through standard web browsing of deployed Storybook instance with `.env` secrets accidentally included in build output.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from .env files when using storybook build command. Unpatched projects building Storybook in directories containing .env files risk bundling sensitive credentials into publicly viewable artifacts. Unauthenticated attackers accessing published Storybook bundles can extract secrets from source code. Runtime dev mode, CI builds using platform environment variables, and co-located applications remain unaffected. No public exploit identified at time of analysis.

RemediationAI

Vendor-released patches: upgrade to Storybook 7.6.21, 8.6.15, 9.1.17, or 10.1.10 immediately on local development machines and CI environments. After upgrading, audit all .env files for exposed secrets and rotate compromised credentials including API keys, database passwords, and authentication tokens. Projects dependent on undocumented .env bundling behavior must migrate to STORYBOOK_ prefixed variables or explicitly define values via Storybook's env configuration property-do not include sensitive data in either approach as patched versions exclude non-prefixed variables but still bundle STORYBOOK_ values. Official advisory with migration guidance: https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6

Affected Packages

npm storybook fix: 7.6.21, 8.6.15, 9.1.17, 10.1.10

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-200 information exposure stems from improper handling of dotenv file parsing during build bundling. Environment variables from .env, .env.local variants are inadvertently included in webpack/vite bundle output without explicit STORYBOOK_ prefix filtering. Affected Node.js Storybook builder code fails to distinguish build-time secrets from intended client-side configuration variables.

Know when Storybook gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Red Hat 7.5 HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 10, 2026 - 20:30 nvd

Patch available

CVE Published

Dec 17, 2025 - 23:16 nvd

HIGH 7.3

DescriptionGitHub Advisory

Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a .env file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the storybook build command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run storybook build directly or indirectly) in a directory that contains a .env file (including variants like .env.local) and publish the built Storybook to the web. Storybooks built without a .env file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than .env files. Storybook runtime environments (i.e. storybook dev) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook-on both their local machines and CI environment-to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via .env files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with STORYBOOK_ or use the env property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.

Executive ViewAI

Why It Matters

Storybook versions 7.0.0-10.1.9 for Node.js contain an information disclosure vulnerability that exposes environment variables from .env files into publicly accessible build artifacts. Organizations using Storybook for component documentation risk leaking sensitive credentials, API keys, and secrets if their projects contain .env files in the build directory. This affects development teams and CI/CD pipelines that publish built Storybook instances without understanding the exposure risk.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Exclude .env files from Storybook build input by moving them to parent directories outside project scope; (2) Implement build-time scanning to detect environment variable strings in final artifacts before deployment; (3) Restrict access to published Storybook instances via authentication or network controls; (4) Rotate all credentials that may have been exposed in previously published bundles; (5) Use CI/CD platform secret management instead of local .env files for sensitive values.

Threat Intelligence Overview

EPSS Score

0.0%

Top 95% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.