Summary
On December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks.
The vulnerability is a bug in how Storybook handles environment variables defined in a .env file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the storybook build command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. If those variables contained secrets, they should be considered compromised.
Who is impacted?
For a project to be vulnerable to this issue, it must:
- Build the Storybook (i.e. run
storybook builddirectly or indirectly) in a directory that contains a.envfile (including variants like.env.local) - The
.envfile contains sensitive secrets - Use Storybook version
7.0.0or above - Publish the built Storybook to the web
Storybooks built without a .env file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than .env files.
Users' Storybook runtime environments (i.e. storybook dev) are not affected. Deployed applications that share a repo with a project's Storybook are not affected.
Storybook 6 and below are not affected.
Recommended actions
First, Storybook recommends that everyone audit for any sensitive secrets provided via .env files and rotate those keys.
Second, Storybook has released patched versions of all affected major Storybook versions that no longer have this vulnerability. Projects should upgrade their Storybook, on both local machines and CI environments, to one of these versions before publishing again.
10.1.10+9.1.17+8.6.15+7.6.21+
Finally, some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, it can either prefix the variables with STORYBOOK_ or use the env property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.
Further information
Details of the vulnerability can be found on the Storybook announcement.
Impact
CVE-2025-68429 has a CVSS score of 7.3 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (7.6.21, 8.6.15, 9.1.17, 10.1.10); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Remediation advice
storybook to 7.6.21 or later; storybook to 8.6.15 or later; storybook to 9.1.17 or later; storybook to 10.1.10 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2025-68429? CVE-2025-68429 is a high-severity security vulnerability in storybook (npm), affecting versions >= 7.0.0, < 7.6.21. It is fixed in 7.6.21, 8.6.15, 9.1.17, 10.1.10.
- How severe is CVE-2025-68429? CVE-2025-68429 has a CVSS score of 7.3 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of storybook are affected by CVE-2025-68429? storybook (npm) versions >= 7.0.0, < 7.6.21 is affected.
- Is there a fix for CVE-2025-68429? Yes. CVE-2025-68429 is fixed in 7.6.21, 8.6.15, 9.1.17, 10.1.10. Upgrade to this version or later.
- Is CVE-2025-68429 exploitable, and should I be worried? Whether CVE-2025-68429 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2025-68429 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2025-68429?
- Upgrade
storybookto 7.6.21 or later - Upgrade
storybookto 8.6.15 or later - Upgrade
storybookto 9.1.17 or later - Upgrade
storybookto 10.1.10 or later
- Upgrade