Vulnerability-Lookup

CVE-2026-8467 (GCVE-0-2026-8467)

Vulnerability from cvelistv5 – Published: 2026-05-20 13:35 – Updated: 2026-05-27 15:41

Title

Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

Summary

Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation. The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to 'Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers':handle_set_variation_assign/3, which stores them verbatim. When rendering, 'Elixir.PhoenixStorybook.Rendering.ComponentRenderer':attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name="<val>" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo" injected={EXPR} bar="), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server. This issue affects phoenix_storybook from 0.5.0 before 1.1.0.

Severity

9.5 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-21 13:57 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 344 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/phenixdigital/phoenix_storyboo…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-8467.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-8467	related
https://github.com/phenixdigital/phoenix_storyboo…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
phenixdigital	phoenix_storybook	Affected: 0.5.0 , < 1.1.0 (semver) cpe:2.3:a:phenixdigital:phoenix_storybook::::::::
phenixdigital	phoenix_storybook	Affected: e35379dfe2ef1a71b141899e36f431017c55265d , < 56ab8464d4375fa52db806148a06cce126ad481d (git) cpe:2.3:a:phenixdigital:phoenix_storybook::::::::

Credits

Nick Mykhailyshyn Cenk Kücük Christian Blavier Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8467",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-21T13:57:52.803277Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-21T13:58:36.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.PhoenixStorybook.Rendering.ComponentRenderer",
            "Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive",
            "Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers"
          ],
          "packageName": "phoenix_storybook",
          "packageURL": "pkg:hex/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/rendering/component_renderer.ex",
            "lib/phoenix_storybook/live/story/playground_preview_live.ex",
            "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "1.1.0",
              "status": "affected",
              "version": "0.5.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.PhoenixStorybook.Rendering.ComponentRenderer",
            "Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive",
            "Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers"
          ],
          "packageName": "phenixdigital/phoenix_storybook",
          "packageURL": "pkg:github/phenixdigital/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/rendering/component_renderer.ex",
            "lib/phoenix_storybook/live/story/playground_preview_live.ex",
            "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "56ab8464d4375fa52db806148a06cce126ad481d",
              "status": "affected",
              "version": "e35379dfe2ef1a71b141899e36f431017c55265d",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.1.0",
                  "versionStartIncluding": "0.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nick Mykhailyshyn"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Cenk K\u00fcc\u00fck"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian Blavier"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCode Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003epsb-assign\u003c/tt\u003e WebSocket event handler in \u003ctt\u003e\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3\u003c/tt\u003e accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to \u003ctt\u003e\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3\u003c/tt\u003e, which stores them verbatim. When rendering, \u003ctt\u003e\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1\u003c/tt\u003e interpolates binary attribute values directly into a HEEx template string as \u003ctt\u003ename=\"\u0026lt;val\u0026gt;\"\u003c/tt\u003e without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. \u003ctt\u003efoo\" injected={EXPR} bar=\"\u003c/tt\u003e), which causes \u003ctt\u003eEXPR\u003c/tt\u003e to be treated as an inline Elixir expression. The resulting template is compiled via \u003ctt\u003eEEx.compile_string/2\u003c/tt\u003e and executed via \u003ctt\u003eCode.eval_quoted_with_env/3\u003c/tt\u003e with full \u003ctt\u003eKernel\u003c/tt\u003e imports and no sandbox, giving the attacker arbitrary code execution on the server.\u003c/p\u003e\u003cp\u003eThis issue affects phoenix_storybook from 0.5.0 before 1.1.0.\u003c/p\u003e"
            }
          ],
          "value": "Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.\n\nThe psb-assign WebSocket event handler in \u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to \u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3, which stores them verbatim. When rendering, \u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name=\"\u003cval\u003e\" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo\" injected={EXPR} bar=\"), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.\n\nThis issue affects phoenix_storybook from 0.5.0 before 1.1.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.5,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T15:41:02.357Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-8467.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-8467"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-8467",
    "datePublished": "2026-05-20T13:35:29.018Z",
    "dateReserved": "2026-05-13T11:44:40.790Z",
    "dateUpdated": "2026-05-27T15:41:02.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-8467",
      "date": "2026-10-30",
      "epss": "0.02111",
      "percentile": "0.81775"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "Elixir.PhoenixStorybook.Rendering.ComponentRenderer",
                  "Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive",
                  "Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers"
                ],
                "packageName": "phoenix_storybook",
                "packageURL": "pkg:hex/phoenix_storybook",
                "product": "phoenix_storybook",
                "programFiles": [
                  "lib/phoenix_storybook/rendering/component_renderer.ex",
                  "lib/phoenix_storybook/live/story/playground_preview_live.ex",
                  "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1"
                  },
                  {
                    "name": "\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3"
                  },
                  {
                    "name": "\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
                  }
                ],
                "repo": "https://github.com/phenixdigital/phoenix_storybook",
                "vendor": "phenixdigital",
                "versions": [
                  {
                    "lessThan": "1.1.0",
                    "status": "affected",
                    "version": "0.5.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "Elixir.PhoenixStorybook.Rendering.ComponentRenderer",
                  "Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive",
                  "Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers"
                ],
                "packageName": "phenixdigital/phoenix_storybook",
                "packageURL": "pkg:github/phenixdigital/phoenix_storybook",
                "product": "phoenix_storybook",
                "programFiles": [
                  "lib/phoenix_storybook/rendering/component_renderer.ex",
                  "lib/phoenix_storybook/live/story/playground_preview_live.ex",
                  "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1"
                  },
                  {
                    "name": "\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3"
                  },
                  {
                    "name": "\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
                  }
                ],
                "repo": "https://github.com/phenixdigital/phoenix_storybook",
                "vendor": "phenixdigital",
                "versions": [
                  {
                    "lessThan": "56ab8464d4375fa52db806148a06cce126ad481d",
                    "status": "affected",
                    "version": "e35379dfe2ef1a71b141899e36f431017c55265d",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.\n\nThe psb-assign WebSocket event handler in \u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to \u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3, which stores them verbatim. When rendering, \u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name=\"\u003cval\u003e\" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo\" injected={EXPR} bar=\"), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.\n\nThis issue affects phoenix_storybook from 0.5.0 before 1.1.0."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de inyecci\u00f3n de c\u00f3digo en phenixdigital phoenix_storybook permite la ejecuci\u00f3n remota de c\u00f3digo no autenticada a trav\u00e9s de la interpolaci\u00f3n de valores de atributos no saneados en la generaci\u00f3n de plantillas HEEx.\n\nEl gestor de eventos WebSocket psb-assign en \u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3 acepta nombres y valores de atributos arbitrarios de clientes no autenticados. Estos valores se pasan a \u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3, que los almacena textualmente. Al renderizar, \u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1 interpola valores de atributos binarios directamente en una cadena de plantilla HEEx como name=\"\u003cval\u003e\" sin escapar las comillas dobles o los delimitadores de expresi\u00f3n HEEx. Un atacante puede proporcionar un valor que contenga una comilla de cierre seguida de un bloque de expresi\u00f3n HEEx (p. ej., foo\" injected={EXPR} bar=\"), lo que hace que EXPR sea tratado como una expresi\u00f3n Elixir en l\u00ednea. La plantilla resultante se compila a trav\u00e9s de EEx.compile_string/2 y se ejecuta a trav\u00e9s de Code.eval_quoted_with_env/3 con importaciones completas del Kernel y sin sandbox, lo que le da al atacante ejecuci\u00f3n de c\u00f3digo arbitrario en el servidor.\n\nEste problema afecta a phoenix_storybook desde 0.5.0 antes de 1.1.0."
          }
        ],
        "id": "CVE-2026-8467",
        "lastModified": "2026-07-23T12:10:00.110",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.5,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-8467",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-21T13:57:52.803277Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-20T14:17:04.283",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-8467.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-8467"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-21T19:57:38+00:00",
      "cve": "CVE-2026-8467",
      "id": "CVE-2026-8467",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8467.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-8467",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-21T13:57:52.803277Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-21T13:58:17.166Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "Elixir.PhoenixStorybook.Rendering.ComponentRenderer",
                "Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive",
                "Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers"
              ],
              "packageName": "phoenix_storybook",
              "packageURL": "pkg:hex/phoenix_storybook",
              "product": "phoenix_storybook",
              "programFiles": [
                "lib/phoenix_storybook/rendering/component_renderer.ex",
                "lib/phoenix_storybook/live/story/playground_preview_live.ex",
                "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1"
                },
                {
                  "name": "\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3"
                },
                {
                  "name": "\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
                }
              ],
              "repo": "https://github.com/phenixdigital/phoenix_storybook",
              "vendor": "phenixdigital",
              "versions": [
                {
                  "lessThan": "1.1.0",
                  "status": "affected",
                  "version": "0.5.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "Elixir.PhoenixStorybook.Rendering.ComponentRenderer",
                "Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive",
                "Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers"
              ],
              "packageName": "phenixdigital/phoenix_storybook",
              "packageURL": "pkg:github/phenixdigital/phoenix_storybook",
              "product": "phoenix_storybook",
              "programFiles": [
                "lib/phoenix_storybook/rendering/component_renderer.ex",
                "lib/phoenix_storybook/live/story/playground_preview_live.ex",
                "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1"
                },
                {
                  "name": "\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3"
                },
                {
                  "name": "\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
                }
              ],
              "repo": "https://github.com/phenixdigital/phoenix_storybook",
              "vendor": "phenixdigital",
              "versions": [
                {
                  "lessThan": "56ab8464d4375fa52db806148a06cce126ad481d",
                  "status": "affected",
                  "version": "e35379dfe2ef1a71b141899e36f431017c55265d",
                  "versionType": "git"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "1.1.0",
                      "versionStartIncluding": "0.5.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Nick Mykhailyshyn"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Cenk K\u00fcc\u00fck"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Christian Blavier"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eCode Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003epsb-assign\u003c/tt\u003e WebSocket event handler in \u003ctt\u003e\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3\u003c/tt\u003e accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to \u003ctt\u003e\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3\u003c/tt\u003e, which stores them verbatim. When rendering, \u003ctt\u003e\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1\u003c/tt\u003e interpolates binary attribute values directly into a HEEx template string as \u003ctt\u003ename=\"\u0026lt;val\u0026gt;\"\u003c/tt\u003e without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. \u003ctt\u003efoo\" injected={EXPR} bar=\"\u003c/tt\u003e), which causes \u003ctt\u003eEXPR\u003c/tt\u003e to be treated as an inline Elixir expression. The resulting template is compiled via \u003ctt\u003eEEx.compile_string/2\u003c/tt\u003e and executed via \u003ctt\u003eCode.eval_quoted_with_env/3\u003c/tt\u003e with full \u003ctt\u003eKernel\u003c/tt\u003e imports and no sandbox, giving the attacker arbitrary code execution on the server.\u003c/p\u003e\u003cp\u003eThis issue affects phoenix_storybook from 0.5.0 before 1.1.0.\u003c/p\u003e"
                }
              ],
              "value": "Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.\n\nThe psb-assign WebSocket event handler in \u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to \u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3, which stores them verbatim. When rendering, \u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name=\"\u003cval\u003e\" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo\" injected={EXPR} bar=\"), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.\n\nThis issue affects phoenix_storybook from 0.5.0 before 1.1.0."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-242",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-242 Code Injection"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 9.5,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-27T15:41:02.357Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-8467.html"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-8467"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-8467",
        "datePublished": "2026-05-20T13:35:29.018Z",
        "dateReserved": "2026-05-13T11:44:40.790Z",
        "dateUpdated": "2026-05-27T15:41:02.357Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-8467

Vulnerability from fkie_nvd - Published: 2026-05-20 14:17 - Updated: 2026-07-23 12:10

Severity

9.5 (Critical) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-8467.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-8467
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.PhoenixStorybook.Rendering.ComponentRenderer",
            "Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive",
            "Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers"
          ],
          "packageName": "phoenix_storybook",
          "packageURL": "pkg:hex/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/rendering/component_renderer.ex",
            "lib/phoenix_storybook/live/story/playground_preview_live.ex",
            "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "1.1.0",
              "status": "affected",
              "version": "0.5.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.PhoenixStorybook.Rendering.ComponentRenderer",
            "Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive",
            "Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers"
          ],
          "packageName": "phenixdigital/phoenix_storybook",
          "packageURL": "pkg:github/phenixdigital/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/rendering/component_renderer.ex",
            "lib/phoenix_storybook/live/story/playground_preview_live.ex",
            "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "56ab8464d4375fa52db806148a06cce126ad481d",
              "status": "affected",
              "version": "e35379dfe2ef1a71b141899e36f431017c55265d",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.\n\nThe psb-assign WebSocket event handler in \u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to \u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3, which stores them verbatim. When rendering, \u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name=\"\u003cval\u003e\" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo\" injected={EXPR} bar=\"), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.\n\nThis issue affects phoenix_storybook from 0.5.0 before 1.1.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyecci\u00f3n de c\u00f3digo en phenixdigital phoenix_storybook permite la ejecuci\u00f3n remota de c\u00f3digo no autenticada a trav\u00e9s de la interpolaci\u00f3n de valores de atributos no saneados en la generaci\u00f3n de plantillas HEEx.\n\nEl gestor de eventos WebSocket psb-assign en \u0027Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive\u0027:handle_event/3 acepta nombres y valores de atributos arbitrarios de clientes no autenticados. Estos valores se pasan a \u0027Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3, que los almacena textualmente. Al renderizar, \u0027Elixir.PhoenixStorybook.Rendering.ComponentRenderer\u0027:attributes_markup/1 interpola valores de atributos binarios directamente en una cadena de plantilla HEEx como name=\"\u003cval\u003e\" sin escapar las comillas dobles o los delimitadores de expresi\u00f3n HEEx. Un atacante puede proporcionar un valor que contenga una comilla de cierre seguida de un bloque de expresi\u00f3n HEEx (p. ej., foo\" injected={EXPR} bar=\"), lo que hace que EXPR sea tratado como una expresi\u00f3n Elixir en l\u00ednea. La plantilla resultante se compila a trav\u00e9s de EEx.compile_string/2 y se ejecuta a trav\u00e9s de Code.eval_quoted_with_env/3 con importaciones completas del Kernel y sin sandbox, lo que le da al atacante ejecuci\u00f3n de c\u00f3digo arbitrario en el servidor.\n\nEste problema afecta a phoenix_storybook desde 0.5.0 antes de 1.1.0."
    }
  ],
  "id": "CVE-2026-8467",
  "lastModified": "2026-07-23T12:10:00.110",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.5,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-8467",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-21T13:57:52.803277Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-20T14:17:04.283",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-8467.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-8467"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-55HG-8QXV-QJ4P

Vulnerability from github – Published: 2026-06-09 21:58 – Updated: 2026-06-09 21:58

Summary

PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

Details

Summary

An unsafe HEEx template generation vulnerability allows any unauthenticated user to execute arbitrary code on the server. The phoenix_storybook playground accepts user-controlled attribute values over WebSocket and interpolates them unsanitized into a HEEx template that is subsequently compiled and evaluated with full Elixir Kernel access.

Details

The vulnerability is a three-step chain:

1. Unsanitized WebSocket input (extra_assigns_helpers.ex) The psb-assign event handler in PhoenixStorybook.Story.PlaygroundPreviewLive accepts arbitrary attribute names and values from unauthenticated WebSocket clients and stores them verbatim via ExtraAssignsHelpers.handle_set_variation_assign/3.

2. Unescaped interpolation into HEEx (component_renderer.ex) ComponentRenderer.attributes_markup/1 builds a HEEx template string by interpolating binary attribute values directly:

{name, val} when is_binary(val) ->
  ~s|#{name}="#{val}"|

No escaping of " or { is performed. A value such as foo" injected={EXPR} bar=" breaks out of the attribute string and injects EXPR as an inline HEEx expression.

3. Unsandboxed evaluation (component_renderer.ex) The resulting HEEx string is compiled via EEx.compile_string/2 and evaluated via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox. The injected expression executes on the server even if it causes a rendering error.

PoC

Identify any story URL with a Playground tab (e.g. /storybook/core_components/button).
Connect to the Phoenix LiveView WebSocket without any authentication.
Join the story's LiveView channel and send a psb-assign event with an attribute value that escapes the HEEx attribute context and embeds an Elixir expression (e.g. a System.cmd/2 call).
The server evaluates the injected expression and returns its output in the rendered response.

No authentication, no special configuration, and no user interaction are required.

Impact

This is a pre-authentication remote code execution vulnerability. Any user able to reach the storybook endpoint, including unauthenticated internet users if the storybook is publicly deployed, can execute arbitrary operating system commands with the privileges of the server process. All versions of phoenix_storybook from 0.5.0 before 1.1.0 are affected.

Resources

Introduction Commit: https://github.com/phenixdigital/phoenix_storybook/commit/e35379dfe2ef1a71b141899e36f431017c55265d
Patch Commit: https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d

Severity

9.5 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "phoenix_storybook"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-8467"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-09T21:58:57Z",
    "nvd_published_at": "2026-05-20T14:17:04Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nAn unsafe HEEx template generation vulnerability allows any unauthenticated user to execute arbitrary code on the server. The phoenix_storybook playground accepts user-controlled attribute values over WebSocket and interpolates them unsanitized into a HEEx template that is subsequently compiled and evaluated with full Elixir `Kernel` access.\n\n### Details\nThe vulnerability is a three-step chain:\n\n**1. Unsanitized WebSocket input (`extra_assigns_helpers.ex`)**\nThe `psb-assign` event handler in `PhoenixStorybook.Story.PlaygroundPreviewLive` accepts arbitrary attribute names and values from unauthenticated WebSocket clients and  stores them verbatim via `ExtraAssignsHelpers.handle_set_variation_assign/3`.\n\n**2. Unescaped interpolation into HEEx (`component_renderer.ex`)**\n`ComponentRenderer.attributes_markup/1` builds a HEEx template string by interpolating binary attribute values directly:\n```elixir\n{name, val} when is_binary(val) -\u003e\n  ~s|#{name}=\"#{val}\"|\n```\nNo escaping of `\"` or `{` is performed. A value such as `foo\" injected={EXPR} bar=\"` breaks out of the attribute string and injects `EXPR` as an inline HEEx expression.\n\n**3. Unsandboxed evaluation (`component_renderer.ex`)**\nThe resulting HEEx string is compiled via `EEx.compile_string/2` and evaluated via `Code.eval_quoted_with_env/3` with full `Kernel` imports and no sandbox. The injected expression executes on the server even if it causes a rendering error.\n\n### PoC\n1. Identify any story URL with a Playground tab (e.g. `/storybook/core_components/button`).\n2. Connect to the Phoenix LiveView WebSocket without any authentication.\n3. Join the story\u0027s LiveView channel and send a `psb-assign` event with an attribute value that escapes the HEEx attribute context and embeds an Elixir expression (e.g. a `System.cmd/2` call).\n4. The server evaluates the injected expression and returns its output in the rendered response.\n\nNo authentication, no special configuration, and no user interaction are required.\n\n### Impact\nThis is a pre-authentication remote code execution vulnerability. Any user able to reach the storybook endpoint, including unauthenticated internet users if the storybook is publicly deployed, can execute arbitrary operating system commands with the privileges of the server process. All versions of `phoenix_storybook` from 0.5.0 before 1.1.0 are affected.\n\n## Resources\n\n* Introduction Commit: https://github.com/phenixdigital/phoenix_storybook/commit/e35379dfe2ef1a71b141899e36f431017c55265d\n* Patch Commit: https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d",
  "id": "GHSA-55hg-8qxv-qj4p",
  "modified": "2026-06-09T21:58:57Z",
  "published": "2026-06-09T21:58:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8467"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-8467.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phenixdigital/phoenix_storybook"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-8467"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-8467 (GCVE-0-2026-8467)

FKIE_CVE-2026-8467

GHSA-55HG-8QXV-QJ4P

Summary

Details

PoC

Impact

Resources

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour