PT-2026-42179 · Unknown · Phoenix Storybook

Cenk Kücük + 3 · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-8467

Positive Technologies (AI Summary)

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions phoenix storybook versions 0.5.0 through 1.0.x

Description Unauthenticated remote code execution is possible due to unsanitized attribute value interpolation during HEEx template generation. The psb-assign WebSocket event handler in the handle event/3 function of Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive accepts arbitrary attribute names and values from unauthenticated clients. These are processed by the handle set variation assign/3 function in Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers and stored verbatim. During rendering, the attributes markup/1 function in Elixir.PhoenixStorybook.Rendering.ComponentRenderer interpolates these values into a HEEx template string without escaping double quotes or expression delimiters. An attacker can inject a closing quote followed by a HEEx expression block, which is then compiled via EEx.compile string/2 and executed via Code.eval quoted with env/3 with full Kernel imports and no sandbox, allowing arbitrary code execution on the server.

Recommendations Update phoenix storybook to version 1.1.0 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-8467

GHSA-55HG-8QXV-QJ4P

Affected Products

Phoenix Storybook

References · 6

• https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d · Patch
• https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-8467 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8467 · Security Note
• https://hex.pm/packages/phoenix_storybook · Note
• https://cna.erlef.org/cves/CVE-2026-8467.html · Note