CVE-2025-68429

A flaw was found in Storybook, a tool for building user interface components. This vulnerability can lead to the unintended exposure of sensitive information. When Storybook is built in a directory containing a .env file and then published online, environment variables from that file may be included in the publicly accessible build artifacts. This allows anyone with access to the published Storybook to view these potentially confidential variables.

This vulnerability is rated Important for Red Hat as it can lead to the unintended exposure of sensitive environment variables. This occurs when a Storybook project is built using the storybook build command in a directory containing a .env file, and the resulting bundle is subsequently published to a web-accessible location. Storybook instances built without .env files or run in development mode (storybook dev) are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.