A sensitive information exposure vulnerability in Storybook allows environment variables stored in local files to be included in public build artifacts, risking the compromise of secrets.

This vulnerability is an information exposure flaw where environment variables defined in local .env files are incorrectly bundled into static assets during the build process, making them accessible to any user with access to the published Storybook. The issue is unauthenticated in nature as the exposed data is contained within publicly accessible web files.

The potential impact of this vulnerability is significant, as it may lead to the unauthorized disclosure of API keys, database credentials, or other sensitive configuration secrets stored within the development environment. With a CVSS score of 7.3, this issue presents a high risk to organizational security, potentially facilitating lateral movement or further unauthorized access to internal systems if the exposed credentials hold elevated privileges.

Immediate Action: Update Storybook to versions 7.6.21, 8.6.15, 9.1.17, 10.1.10, or later to ensure that environment variables are properly handled during the build process.

Proactive Monitoring: Review existing deployments of Storybook to check for the presence of sensitive variables in generated build artifacts and audit access logs for suspicious requests targeting configuration files.

Compensating Controls: Ensure that sensitive secrets are injected via secure CI/CD environment variables rather than local .env files, and restrict public access to Storybook documentation sites if they contain potentially sensitive build data.

Public Exploit Available: Unknown

Organizations utilizing Storybook must prioritize the transition to the patched versions specified above to prevent the accidental leakage of sensitive configuration data. Given the ease with which static assets are indexed and accessed, immediate remediation is required to protect against potential credential harvesting from public-facing build artifacts.