Is CVE-2025-68429 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-68429 being exploited in the wild.

How severe is CVE-2025-68429?

Low severity, with a CVSS score of 3.1, published 18 December 2025.

Which products and versions are affected?

storybook (npm) SEMVER:introduced=7.0.0,fixed=7.6.21.

Is there a fix for CVE-2025-68429?

Yes. storybook (npm): upgrade to 7.6.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-68429 attacked?

It is attacked over the network.

Am I affected by CVE-2025-68429?

Check whether you run storybook (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68429: Storybook environment variable exposure in build artifacts

CVE-2025-68429 · Severity: low · CVSS 3.1 · Published 2025-12-18

Storybook, a popular tool for developing and documenting UI components, accidentally bundles sensitive environment variables from .env files into published web artifacts when building projects. Anyone viewing the published Storybook's source code can read these exposed secrets, which may include API keys, database passwords, and other credentials. Organizations that built and published Storybooks containing .env files with secrets should immediately rotate those credentials and upgrade to patched versions.

Technologies: storybook (npm). Vendors: npm.

Quick answers

Is CVE-2025-68429 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-68429 being exploited in the wild.
How severe is CVE-2025-68429?: Low severity, with a CVSS score of 3.1, published 18 December 2025.
Which products and versions are affected?: storybook (npm) SEMVER:introduced=7.0.0,fixed=7.6.21.
Is there a fix for CVE-2025-68429?: Yes. storybook (npm): upgrade to 7.6.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68429 attacked?: It is attacked over the network.
Am I affected by CVE-2025-68429?: Check whether you run storybook (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

storybook (npm): upgrade to 7.6.21 or later
```
npm install storybook@7.6.21
```

Technical details

The vulnerability is an information disclosure issue (CWE-200, CWE-538, CWE-541) in how Storybook processes environment variables during the build step. Environment variables defined in .env or .env.local files are unexpectedly bundled into the output artifacts generated by the `storybook build` command. When these built artifacts are deployed to a web server, the bundle source code is publicly viewable, exposing any secrets contained in those variables. The issue affects Storybook versions 7.0.0 and above only when: a .env file with secrets is present during the build, and the resulting build is published to the web. Common CI/CD setups that provide secrets via environment variables (not .env files) are unaffected. Patches are available in versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 and above.

Affected products

Storybook Storybook 7.0.0 to 7.6.20, 8.0.0 to 8.6.14, 9.0.0 to 9.1.16, 10.0.0 to 10.1.9

Identifiers

CVE-2025-68429
GHSA-8452-54wp-rmv6

Timeline

2025-12-18: disclosed
2025-12-18: patched: Patched versions released: 7.6.21, 8.6.15, 9.1.17, 10.1.10+

References

https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.