{"action":"Upgrade storybook to 7.6.21 or later.","affected":[{"fixed":"7.6.21","introduced":"7.0.0"},{"fixed":"8.6.15","introduced":"8.0.0"},{"fixed":"9.1.17","introduced":"9.0.0"},{"fixed":"10.1.10","introduced":"10.0.0"}],"component":"storybook","cve_ids":["CVE-2025-68429"],"ecosystem":"npm","epss":0.00257,"exploited":false,"fixed_versions":["7.6.21","8.6.15","9.1.17","10.1.10"],"ghsa_id":"GHSA-8452-54wp-rmv6","id":"tcs_01M5KFBMNAXHMFY5Z4GXAAC055","modified_at":"2026-09-10T03:50:31.796824882Z","published_at":"2025-12-18T18:49:21Z","references":["https://osv.dev/vulnerability/GHSA-8452-54wp-rmv6","https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6","https://nvd.nist.gov/vuln/detail/CVE-2025-68429","https://github.com/storybookjs/storybook","https://storybook.js.org/blog/security-advisory"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-8452-54wp-rmv6","url":"https://osv.dev/vulnerability/GHSA-8452-54wp-rmv6"}],"summary":"Storybook manager bundle may expose environment variables during build"}