CVE-2026-8467
CriticalCVSS 9.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
The phoenix_storybook library from version 0.5.0 before 1.1.0 contains a code injection vulnerability allowing unauthenticated remote code execution. The vulnerability is in the psb-assign WebSocket event handler, where attribute names and values from unauthenticated clients are stored without sanitization and then interpolated into a HEEx template without proper escaping. This allows injection of an Elixir expression that is compiled and executed on the server.
Risk Assessment
An attacker can remotely execute arbitrary Elixir code on the server, leading to full system compromise, data theft, or application takeover.
Recommendation
Update phoenix_storybook to version 1.1.0 or later, which fixes this vulnerability.
Original NVD description (English source)
Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation. The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to 'Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers':handle_set_variation_assign/3, which stores them verbatim. When rendering, 'Elixir.PhoenixStorybook.Rendering.ComponentRenderer':attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name="<val>" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo" injected={EXPR} bar="), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server. This issue affects phoenix_storybook from 0.5.0 before 1.1.0.