CVE-2025-68429CWE-200CWE-538CWE-541

Storybook manager bundle may expose environment variables during build

High · published December 17, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

🚨 A sneaky little oversight in Storybook could expose your `.env` secrets during builds! If your project runs `storybook build`, you might be giving away the keys to the kingdom! 🔑😱 Think of it like accidentally including confidential notes in a delivery of your latest project presentation — those notes weren't meant for public eyes! If you build your Storybook in a directory with a `.env` file, it might just slip through the cracks and end up viewable by anyone online. If exposed, sensitive information like API keys and database credentials could be seen by anyone accessing your Storybook deployment. This is absolutely devastating for your project's security, potentially leading to unauthorized access and data breaches! 🔥

Put simply

Think of it like accidentally including confidential notes in a delivery of your latest project presentation — those notes weren't meant for public eyes! If you build your Storybook in a directory with a `.env` file, it might just slip through the cracks and end up viewable by anyone online. This vulnerability arises from Storybook incorrectly bundling environment variables defined in `.env` files during the `storybook build` command, making them visible in the final built artifacts. If secrets are included, attackers may easily gain access to critical information.

What to do

If exposed, sensitive information like API keys and database credentials could be seen by anyone accessing your Storybook deployment. This is absolutely devastating for your project's security, potentially leading to unauthorized access and data breaches! 🔥 To mitigate this, upgrade your Storybook to version 7.6.21, 8.6.15, 9.1.17, or 10.1.10 immediately. Additionally, audit your `.env` files for sensitive information, rotate any exposed secrets, and use the `STORYBOOK_` prefix or the `env` property for any necessary environment variables in your configuration. You've got this! By following these steps, you'll fortify your Storybook and keep your secrets safe! 🛡️✨

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00261 · 17.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory; CWE-541 · Inclusion of Sensitive Information in an Include File
Published
2025-12-17T22:26Z
EPSS history
Timeline
  • 17 DEC 22:26Z
    Storybook manager bundle may expose environment variables during build
    cvelistv5