PT-2026-42180 · Phenixdigital · Phoenix Storybook

Christian Blavier + 2 · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-8469

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions phenixdigital phoenix storybook versions 0.2.0 through 1.0.x

Description An unauthenticated denial-of-service can occur via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.to atom/1 without validation. Specifically, the following functions are affected:

• handle set variation assign/3 interns every key of the psb-assign params map.
• handle toggle variation assign/3 interns the attr value from psb-toggle events.
• to variation id/2 interns elements of variation id.
• to value/4 interns raw string values for attributes declared as :atom or :boolean.

BEAM atoms are never garbage-collected, meaning each unique attacker-controlled string results in a permanent allocation. When the atom table ceiling of approximately 1,048,576 atoms is reached, the entire BEAM node aborts, causing all applications running on it to crash.

Recommendations Update to version 1.1.0 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-8469

GHSA-833P-95JQ-929Q

Affected Products

Phoenix Storybook

References · 6

• https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81 · Patch
• https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8469 · Security Note
• https://osv.dev/vulnerability/EEF-CVE-2026-8469 · Vendor Advisory
• https://cna.erlef.org/cves/CVE-2026-8469.html · Note
• https://hex.pm/packages/phoenix_storybook · Note