The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Check two separate Storybook security issues: CVE-2025-68429 can expose secrets from a .env file in a published Storybook build under specific conditions; CVE-2026-27148 affects WebSocket connections to the development server. The fixes differ by release branch. Upgrade to a version that fixes both issues affecting your branch, check whether a vulnerable dev server was publicly reachable, and rotate any secrets that may have been published.
Which Storybook security issues are involved?
The advisories concern different components and exposure scenarios. The first is about what can end up in a generated, published build. The second is about connections to a running development server. A production build is not affected by the WebSocket issue, and the .env advisory excludes storybook dev.
As an Amazon Associate I earn from qualifying purchases.
| Issue | Affected component | Exposure condition | Main response |
|---|---|---|---|
| CVE-2025-68429 | Published Storybook build | A qualifying Storybook version builds in a directory containing a .env file with secrets, and the resulting build is published. | Audit the build and rotate secrets that may have been included. |
| CVE-2026-27148 | Storybook development server | A developer visits a malicious website while a vulnerable local dev server is running, or an exposed dev server can be reached directly. | Upgrade to the branch’s fixed version and review public reachability. |
Could a published Storybook build expose .env secrets?
Storybook’s advisory, published December 17, 2025, describes cases where variables defined in a .env file could be bundled into artifacts produced by storybook build. The risk applies only when all the relevant conditions coincide:
- Storybook is version 7.0.0 or later.
- The build runs in a directory containing a
.envfile, including variants such as.env.local. - The file contains sensitive secrets.
- The generated Storybook is published to the web.
The advisory says a build without a .env file present at build time is not affected, including common CI builds where secrets are supplied through platform environment variables. It also says Storybook 6 and earlier are not affected. This issue does not affect storybook dev or deployed applications that share the repository.
#1 Best Overall
What to do if a published build may contain secrets
- Identify published Storybook builds made with an affected version and a .env file present in the build directory.
- Determine whether that file contained sensitive values. Treat any secret that may have been bundled into a published artifact as compromised.
- Rotate affected credentials and review where they were used. Storybook’s advisory says secrets in this situation should be considered compromised.
- Upgrade local and CI installations before publishing another build.
- Keep secrets out of values exposed to the generated Storybook bundle. For required non-secret values, the advisory recommends using a
STORYBOOK_prefix or Storybook’senvconfiguration property.
Is Storybook’s development server vulnerable to WebSocket hijacking?
Yes, if it is running a vulnerable version. Storybook’s GitHub advisory, published February 25, 2026, says the dev server’s WebSocket functionality did not validate the origin of incoming connections. A malicious website can send WebSocket messages to a developer’s local Storybook instance if the developer visits that site while the vulnerable server is running; the advisory says no further interaction is required. If a dev server is intentionally exposed publicly, an attacker may connect to it directly, increasing the risk.
The advisory rates the issue High, with an overall CVSS score of 8.9. It says the exploitable functionality was introduced in version 8.1, while the fix was also applied to 7.x as a precaution. Production builds are not affected by this WebSocket issue.
Reduce exposure while upgrading
- Upgrade to the fixed version for your branch, shown below.
- Check whether any development server is reachable from the public internet and restrict access if it does not need to be public.
- Include developer machines as well as CI in the upgrade: the attack scenario involves a local server running while its user visits a malicious site.
Which versions fix both advisories?
The minimum versions differ by advisory. Where a branch has fixes for both issues, use the later WebSocket fix so the installation covers both relevant advisories.
| Release branch | .env build issue fixed in | WebSocket issue fixed in | Minimum shown here to cover both |
|---|---|---|---|
| 7.x | 7.6.21 | 7.6.23 | 7.6.23 |
| 8.x | 8.6.15 | 8.6.17 | 8.6.17 |
| 9.x | 9.1.17 | 9.1.19 | 9.1.19 |
| 10.x | 10.1.10 | 10.2.10 | 10.2.10 |
These are the versions listed in the respective advisories, current as of October 3, 2026. Confirm that the version you choose is still supported before upgrading. Storybook says security fixes are made on the latest major version, with backports for High or Critical issues to the previous two major versions; older versions are unsupported.
How should teams triage and remediate?
- Inventory versions. Identify the Storybook version and branch used on developer machines and in CI.
- Check build history for CVE-2025-68429. Establish whether builds were made with a .env file present and whether it contained secrets. If a published bundle may include secrets, rotate them.
- Check server exposure for CVE-2026-27148. Upgrade the dev server and review whether it was intentionally reachable from the public internet.
- Patch before publishing again. Upgrade local and CI installations to a version that fixes the relevant issue or issues on that branch.
- Review bundle inputs. Do not put secrets in values intended for the generated Storybook bundle. Use the advisory’s suggested configuration approach only for non-secret values.
The .env advisory said no exploited project had been reported to the Storybook team at the time it was published. That is not evidence that a particular build is safe; assess your own build conditions and contents.
ScreenshotNeo is a separate tool, not a Storybook security fix
ScreenshotNeo is a website screenshot API and MCP server, not a vulnerability scanner or a replacement for the Storybook upgrades and secret rotation described above. If you separately need to capture web pages, it can return a screenshot or PDF from a GET request. Its clean-shot options remove known consent banners, newsletter popups and chat widgets before capture, and its response identifies page verdict and billing status. See ScreenshotNeo for details.
Sign up for ScreenshotNeo to get 1,000 screenshots a month free with no card.
Recommended Free Tools
Frequently Asked Questions
Does CVE-2026-27148 affect a deployed production Storybook build?
No. The advisory identifies the development server’s WebSocket functionality as affected and says production builds are not impacted by this issue.
Does using CI mean a Storybook build cannot be affected by CVE-2025-68429?
Not by itself. The advisory excludes common CI builds that use platform environment variables when there is no .env file at build time; check whether a .env file was actually present in the build directory.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
