Critical Storybook Flaw May Leak API Keys and Database Passwords

Background

Just after a serious React security issue was disclosed, the frontend component tool Storybook announced a new critical vulnerability.

What happened?

The bug (CVE‑2025‑68429) occurs when Storybook 7.0 or later processes environment variables during a build. If a project uses a .env file and runs storybook build, Storybook may mistakenly embed the entire .env content into the generated static files.

Impact

Because the built Storybook site is static, anyone who can access the deployed page can view the source or network requests and retrieve secrets such as API keys and database passwords that were intended to stay private.

Who is affected? (Self‑check)

Version range : Storybook 7.0.0 and above.

Build environment : The build is executed in a directory that contains a .env (or variants like .env.local) and the command storybook build is run.

Code pattern : The project’s code (e.g., manager.js/ts or a plugin) accesses environment variables via patterns such as:

Destructuring: const { MY_SECRET } = process.env Object spread: { ...process.env } Direct assignment: const env = process.env Public deployment : The built Storybook is published to the public internet.

Note : CI/CD pipelines that inject variables without a physical .env file, or local storybook dev runs, are typically not affected.

Plugin risk

The official audit found that several widely used plugins in the top‑100 Storybook ecosystem also trigger the bug, including @chromatic-com/storybook (Visual Tests addon) and @storybook/addon-designs. Even careful code can be compromised by a vulnerable plugin.

How to remediate

The maintainers have released emergency patches. The recommended action is to upgrade immediately to a safe version:

v10.x → 10.1.10+ v9.x → 9.1.17+ v8.x → 8.6.15+ v7.x → 7.6.21+ Before rebuilding and redeploying, rotate any potentially exposed keys.

Broader lesson

Frontend build tools such as Webpack, Vite, and Storybook treat the final bundle as fully public static assets. Storing production secrets in a .env file and assuming they remain backend‑only is unsafe. The best practice is to avoid placing real secrets in .env files that become part of the build; instead inject them via CI/CD platform variables.

Reference:

Storybook Security Advisory: https://storybook.js.org/blog/security-advisory/*