--- title: "Security advisory" url: https://daily.dev/posts/security-advisory-w0nuexlkl source_url: https://storybook.js.org/blog/security-advisory/ type: article source: "Storybook" published: 2025-12-17T15:52:28.583Z updated: 2025-12-17T15:52:49.527Z tags: ["security", "javascript", "vulnerability", "storybook"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security advisory **[Storybook](https://daily.dev/sources/storybook)** · 5 min read · 0 upvotes · 0 comments ## Summary Storybook versions 7-10 contain a vulnerability where environment variables from .env files could be unexpectedly bundled into published builds, potentially exposing secrets. The issue affects projects that build Storybook with .env files present and publish to the web. Patches are available for versions 7.6.21+, 8.6.15+, 9.1.17+, and 10.1.10+. Users should rotate any exposed secrets and upgrade immediately before publishing again. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [GHSA-96qw-h329-v5rg \(shakapacker\): Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles](https://daily.dev/posts/ghsa-96qw-h329-v5rg-shakapacker-shakapacker-has-environment-variable-leak-via-environmentplugin-t-hjubnchrn) · RUBYLAND · 0 upvotes · 0 comments - [The File That Hands Attackers Your Entire Server](https://daily.dev/posts/the-file-that-hands-attackers-your-entire-server-orzmzxctl) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#vulnerability](https://daily.dev/tags/vulnerability), [#storybook](https://daily.dev/tags/storybook) [View this post on daily.dev](https://daily.dev/posts/security-advisory-w0nuexlkl)