CVE-2025-68429
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3Description
Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook-on both their local machines and CI environment-to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.
Analysis
Information disclosure in Storybook for Node.js versions 7.0.0 through 10.1.9 exposes environment variables from .env files when using storybook build command. Unpatched projects building Storybook in directories containing .env files risk bundling sensitive credentials into publicly viewable artifacts. Unauthenticated attackers accessing published Storybook bundles can extract secrets from source code. Runtime dev mode, CI builds using platform environment variables, and co-located applications remain unaffected. No public exploit identified at time of analysis.
Technical Context
CWE-200 information exposure stems from improper handling of dotenv file parsing during build bundling. Environment variables from `.env`, `.env.local` variants are inadvertently included in webpack/vite bundle output without explicit STORYBOOK_ prefix filtering. Affected Node.js Storybook builder code fails to distinguish build-time secrets from intended client-side configuration variables.
Affected Products
Storybook for Node.js, vendor Storybook. Vulnerable versions: 7.0.0 to 7.6.20, 8.0.0 to 8.6.14, 9.0.0 to 9.1.16, 10.0.0 to 10.1.9. CPE: cpe:2.3:a:storybook:storybook:*:*:*:*:*:node.js:*:*
Remediation
Vendor-released patches: upgrade to Storybook 7.6.21, 8.6.15, 9.1.17, or 10.1.10 immediately on local development machines and CI environments. After upgrading, audit all `.env` files for exposed secrets and rotate compromised credentials including API keys, database passwords, and authentication tokens. Projects dependent on undocumented `.env` bundling behavior must migrate to STORYBOOK_ prefixed variables or explicitly define values via Storybook's `env` configuration property-do not include sensitive data in either approach as patched versions exclude non-prefixed variables but still bundle STORYBOOK_ values. Official advisory with migration guidance: https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today