CVE-2025-68429VulnerabilityPublished 17 Dec 2025

CVE-2025-68429: storybookjs storybook · Information Exposure

Affects storybookjs storybookSource CVE Database V5

Not known to be exploited · CVSS 7.3 High.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

7.3High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

European organizations should immediately upgrade all Storybook instances—both local development environments and CI/CD pipelines—to the patched versions 7.6.21, 8.6.15, 9.1.17, or 10.1.10. Conduct a thorough audit of all .env files used during Storybook builds to identify any sensitive secrets that may have been exposed. Rotate all potentially compromised keys, tokens, and credentials promptly. Modify build processes to avoid placing .env files containing secrets in the build directory or use CI environment variables instead, as these are not bundled into the build artifacts. For projects relying on the previous behavior, refactor environment variable usage by prefixing variables with 'STORYBOOK_' or explicitly defining them in Storybook’s configuration 'env' property, ensuring no sensitive information is included. Implement access controls on published Storybook artifacts, restricting public exposure where possible. Regularly review and monitor public repositories and artifact hosting sites for accidental leaks. Incorporate automated scanning tools in CI pipelines to detect inclusion of sensitive data in build outputs. Finally, educate development teams about secure environment variable management and the risks of bundling secrets in frontend artifacts.

Description

Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e.run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook—on both their local machines and CI environment—to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.

Impact

For European organizations, this vulnerability poses a significant risk of sensitive information leakage, particularly for companies that use Storybook to build and publish UI component libraries publicly or internally. Exposure of environment variables can lead to unauthorized access to APIs, databases, or third-party services, potentially resulting in data breaches, service disruptions, or further exploitation. Organizations in sectors with strict data protection regulations, such as finance, healthcare, and government, may face compliance violations under GDPR if sensitive data is exposed. The risk is heightened for organizations that store critical secrets in .env files within the build directory and publish Storybook artifacts without proper controls. The vulnerability could facilitate lateral movement or privilege escalation if attackers leverage exposed credentials. Although no known exploits are reported in the wild yet, the ease of exploitation (no authentication or user interaction required) and the public availability of source bundles increase the likelihood of opportunistic attacks. The impact extends to the integrity and availability of services if attackers use exposed secrets to manipulate or disrupt operations.

Summary

CVE-2025-68429 is a vulnerability in Storybook, a widely used frontend development tool that allows developers to build UI components in isolation. The flaw arises from how Storybook handles environment variables defined in .env files during the static build process initiated by the 'storybook build' command. Specifically, when a .env file is present in the build directory, Storybook may inadvertently bundle these environment variables—including sensitive secrets such as API keys or credentials—into the generated static artifacts. Since these artifacts are often published to public or internal web servers, the bundled source code becomes accessible to anyone with access, leading to exposure of sensitive information to unauthorized actors. This issue affects Storybook versions starting from 7.0.0 up to but excluding versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10. Notably, builds performed without .env files, such as those using CI environments that inject secrets via platform environment variables, are not vulnerable. The vulnerability does not impact the Storybook runtime environment ('storybook dev') or deployed applications that share the same repository. The root cause is an undocumented behavior in Storybook’s environment variable handling that was unintentionally exposing secrets. To remediate, users must upgrade to the fixed versions, audit their .env files for sensitive data, and rotate any exposed secrets. Additionally, projects that depended on the old behavior need to modify how environment variables are referenced, either by prefixing variables with 'STORYBOOK_' or specifying them explicitly in Storybook’s configuration, ensuring no sensitive secrets are included in the build artifacts.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Logging (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
V7.3.3 (opens in a new tab)
Attack patterns
Subverting Environment Variable Values (opens in a new tab)
ICMP Echo Request Ping (opens in a new tab)
TCP SYN Scan (opens in a new tab)
Enumerate Mail Exchange (MX) Records (opens in a new tab)
DNS Zone Transfers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Architecture and Design · Operation · System Configuration
Do not expose file and directory information to the user.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Logging (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
V7.3.3 (opens in a new tab)
Attack patterns
WSDL Scanning (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-541Inclusion of Sensitive Information in an Include File (opens in a new tab)
Variant weaknessOWASP Top 10 A05:2021: Security Misconfiguration (opens in a new tab)
If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.
Architecture and Design
Do not store sensitive information in include files.
Architecture and Design · System Configuration
Protect include files from being exposed.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Logging (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
V7.3.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 25 Dec 2025, 00:11 UTC

WeaknessesCWE-200, CWE-538, CWE-541

Technical details

References

Community reviews

Related threats