# CVE-2025-68429: Storybook environment variable exposure in build artifacts

Source: https://junglewise.ai/threats/cve-2025-68429-storybook-environment-variable-exposure-in-build-artifacts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-68429 · Severity: low · CVSS 3.1 · Published 2025-12-18

Storybook, a popular tool for developing and documenting UI components, accidentally bundles sensitive environment variables from .env files into published web artifacts when building projects. Anyone viewing the published Storybook's source code can read these exposed secrets, which may include API keys, database passwords, and other credentials. Organizations that built and published Storybooks containing .env files with secrets should immediately rotate those credentials and upgrade to patched versions.

Technologies: [storybook (npm)](https://junglewise.ai/threats/technologies/npm-storybook). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-68429 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68429 being exploited in the wild.

**How severe is CVE-2025-68429?** Low severity, with a CVSS score of 3.1, published 18 December 2025.

**Which products and versions are affected?** storybook (npm) SEMVER:introduced=7.0.0,fixed=7.6.21.

**Is there a fix for CVE-2025-68429?** Yes. storybook (npm): upgrade to 7.6.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-68429 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-68429?** Check whether you run storybook (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- storybook (npm): upgrade to 7.6.21 or later

  ```sh
  npm install storybook@7.6.21
  ```


## Technical details

The vulnerability is an information disclosure issue (CWE-200, CWE-538, CWE-541) in how Storybook processes environment variables during the build step. Environment variables defined in .env or .env.local files are unexpectedly bundled into the output artifacts generated by the `storybook build` command. When these built artifacts are deployed to a web server, the bundle source code is publicly viewable, exposing any secrets contained in those variables. The issue affects Storybook versions 7.0.0 and above only when: a .env file with secrets is present during the build, and the resulting build is published to the web. Common CI/CD setups that provide secrets via environment variables (not .env files) are unaffected. Patches are available in versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 and above.

## Affected products

- Storybook Storybook 7.0.0 to 7.6.20, 8.0.0 to 8.6.14, 9.0.0 to 9.1.16, 10.0.0 to 10.1.9

## Identifiers

- CVE-2025-68429
- GHSA-8452-54wp-rmv6

## Timeline

- 2025-12-18: disclosed
- 2025-12-18: patched: Patched versions released: 7.6.21, 8.6.15, 9.1.17, 10.1.10+

## References

- [https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6](https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6)

## Related threats

- [Storybook WebSocket token exposure and code execution](https://junglewise.ai/threats/cve-2026-114126-storybook-is-a-frontend-workshop-for-building-user-interface)
- [Storybook missing origin validation in preview allows code injection](https://junglewise.ai/threats/cve-2026-114125-storybook-missing-origin-validation-in-storybook-preview-allows)
- [Storybook WebSocket hijacking and RCE in development server](https://junglewise.ai/threats/cve-2026-27148-storybook-websocket-hijacking-and-rce-in-development-server)