Security Bulletin: Vulnerabilities in Storybook affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Potential vulnerability in Storybook has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-68429 DESCRIPTION:...

@asherng/storybook (>=0.0.18, <=0.1.14), @bluefin-exchange/starship-v2 (>=1.1.1, <=1.1.16) +32 more potentially affected by CVE-2025-68429 via storybook (>=7.0.6, <=7.6.20)

storybook NPM version =7.0.6, =0.0.18, =1.1.1, =0.0.1, =0.0.4, =1.2.108, =3.50.0-next.2, =9.0.0-next.4, =1.0.967, =0.0.1, =1.0.0-beta.1, =1.2.2, =0.0.1, =0.0.1, =7.6.4-next.32, =6.0.0-canary.234, =6.0.0-canary.318 and more Source cves: CVE-2025-68429 Source advisory: OSV:GHSA-8452-54WP-RMV6...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +31 more potentially affected by CVE-2025-68429 via storybook (>=8.0.2, <=8.6.14)

storybook NPM version =8.0.2, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.5.1-canary.0, =0.4.2, =0.1.3, =1.0.0-canary.12734, =0.11.1-aa792aa-20250325153437, =0.12.1-aa792aa-20250325153437, =0.0.1-10adad4-20260325085110, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =7.33.6-qa-airteam-7.35.1.0,...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @cedarjs/cli-storybook-vite (>=1.0.0-canary.12742, <=1.0.0-canary.12784) +14 more potentially affected by CVE-2025-68429 via storybook (>=9.0.0, <=9.1.16)

storybook NPM version =9.0.0, =0.0.1, =1.0.0-canary.12742, =0.0.2-alpha.0, =1.0.0, =1.1.0, =0.1.80, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.2, =9.0.0-alpha.0, =1.2.1, =0.0.75-beta.11, =0.2.7, =0.2.8 and more Source cves: CVE-2025-68429 Source advisory: OSV:GHSA-8452-54WP-RMV6...

@asherng/storybook (>=0.0.18, <=0.1.14), @bluefin-exchange/starship-v2 (>=1.1.1, <=1.1.16) +32 more potentially affected by CVE-2025-68429 via storybook (>=7.0.6, <=7.6.20)

storybook NPM version =7.0.6, =0.0.18, =1.1.1, =0.0.1, =0.0.4, =1.2.108, =3.50.0-next.2, =9.0.0-next.4, =1.0.967, =0.0.1, =1.0.0-beta.1, =1.2.2, =0.0.1, =0.0.1, =7.6.4-next.32, =6.0.0-canary.234, =6.0.0-canary.318 and more Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOK-14534871...

31g-form-parser (>=1.0.1, <=1.0.126), @1024pix/storybook-ember (7.1.1) +205 more potentially affected by CVE-2025-68429 via @storybook/core-common (>=7.0.0, <=7.6.20)

@storybook/core-common NPM version =7.0.0, =1.0.1, =3.0.0, =0.1.0, =0.0.18, =2.0.5, =1.1.1, =0.0.1, =0.0.4, =0.38.0-rc.0, =0.38.0-rc.4 - @clds/menu-next 0.38.0 and more Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOKCORECOMMON-14470053...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +31 more potentially affected by CVE-2025-68429 via storybook (>=8.0.2, <=8.6.14)

storybook NPM version =8.0.2, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.5.1-canary.0, =0.4.2, =0.1.3, =1.0.0-canary.12734, =0.11.1-aa792aa-20250325153437, =0.12.1-aa792aa-20250325153437, =0.0.1-10adad4-20260325085110, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =7.33.6-qa-airteam-7.35.1.0,...

@abovethefray/klaviyo-adobe-commerce-app-checkout-consent-dropin (>=0.0.1, <=1.0.0), @adobe-commerce/elsie (>=1.0.0-alpha04071347, <=2.0.0-alpha-20260514091936) +114 more potentially affected by CVE-2025-68429 via @storybook/core-common (>=8.0.0, <=8.6.14)

@storybook/core-common NPM version =8.0.0, =0.0.1, =1.0.0-alpha04071347, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.0.213-beta.38, =0.38.0, =0.41.1, =1.0.0, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =0.1.0-alpha.39, =1.16.0, =1.17.0 and more Source cves: CVE-2025-68429 Source advisory:...

@storybook/angular (>=9.0.0-alpha.0, <=9.1.16), @storybook/ember (>=9.0.0-alpha.0, <=9.1.16) +49 more potentially affected by CVE-2025-68429 via @storybook/builder-webpack5 (>=9.0.0, <=9.1.16)

@storybook/builder-webpack5 NPM version =9.0.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.0, =1.7.54, =1.7.48, =1.7.56, =1.11.1, =1.8.58, =1.14.15 and more Source cves: CVE-2025-6842...

@storybook/cli (>=10.0.0-beta.0, <=10.1.9), @storybook/codemod (>=10.0.0-beta.0, <=10.1.9) +5 more potentially affected by CVE-2025-68429 via storybook (>=10.0.0, <=10.1.9)

storybook NPM version =10.0.0, =10.0.0-beta.0, =10.0.0-beta.0, =12.0.7, =12.0.5, =10.0.0-beta.0, =10.0.0-beta.0, =10.1.9 Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOK-14534871...

@1024pix/storybook-ember (7.1.1), @anansi/storybook (>=0.1.0, <=0.3.0) +32 more potentially affected by CVE-2025-68429 via @storybook/builder-webpack5 (>=7.0.0, <=7.6.20)

@storybook/builder-webpack5 NPM version =7.0.0, =0.1.0, =0.0.18, =0.0.0-dev-main.202308160724, =1.6.5, =3.50.0-next.2, =9.0.0-next.3, =0.1.3, =0.0.1, =7.4.0-alpha.2.1, =8.0.0-dev.0cd7fcb, =1.0.0-alpha.4, =0.0.2, =0.0.1, =6.0.0-canary.234, =6.0.0-canary.318 and more Source cves: CVE-2025-68429...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @cedarjs/cli-storybook-vite (>=1.0.0-canary.12742, <=1.0.0-canary.12784) +14 more potentially affected by CVE-2025-68429 via storybook (>=9.0.0, <=9.1.16)

storybook NPM version =9.0.0, =0.0.1, =1.0.0-canary.12742, =0.0.2-alpha.0, =1.0.0, =1.1.0, =0.1.80, =9.0.0-alpha.0, =9.0.0-alpha.0, =9.0.0-alpha.2, =9.0.0-alpha.0, =1.2.1, =0.0.75-beta.11, =0.2.7, =0.2.8 and more Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOK-14534871...

@abovethefray/klaviyo-adobe-commerce-app-checkout-consent-dropin (>=0.0.1, <=1.0.0), @adobe-commerce/elsie (>=1.0.0-alpha04071347, <=2.0.0-alpha-20260514091936) +51 more potentially affected by CVE-2025-68429 via @storybook/builder-webpack5 (>=8.0.0, <=8.6.14)

@storybook/builder-webpack5 NPM version =8.0.0, =0.0.1, =1.0.0-alpha04071347, =0.2.9, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =0.11.1-aa792aa-20250325153437, =0.12.1-aa792aa-20250325153437, =0.0.1-10adad4-20260325085110, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =9.0.0-next.67 and more...

@storybook/angular (>=10.0.0-beta.0, <=10.1.9), @storybook/ember (>=10.0.0-beta.0, <=10.1.9) +3 more potentially affected by CVE-2025-68429 via @storybook/builder-webpack5 (>=10.0.0, <=10.1.9)

@storybook/builder-webpack5 NPM version =10.0.0, =10.0.0-beta.0, =10.0.0-beta.0, =10.0.0-beta.0, =10.0.0-beta.0, =10.0.0-beta.0, =10.1.9 Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOKBUILDERWEBPACK5-14470054...