CVE-2026-8467Critical▾ AbyssalPoC availablePhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.3 · likelihood 0.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.9%
1 GitHub repo
0.9% → 2.1%
An unsafe HEEx template generation vulnerability allows any unauthenticated user to execute arbitrary code on the server. The phoenix_storybook playground accepts user-controlled attribute values over WebSocket and interpolates them unsanitized into a HEEx template that is subsequently compiled and evaluated with full Elixir Kernel access.
The vulnerability is a three-step chain:
1. Unsanitized WebSocket input (extra_assigns_helpers.ex)
The psb-assign event handler in PhoenixStorybook.Story.PlaygroundPreviewLive accepts arbitrary attribute names and values from unauthenticated WebSocket clients and stores them verbatim via ExtraAssignsHelpers.handle_set_variation_assign/3.
2. Unescaped interpolation into HEEx (component_renderer.ex)
ComponentRenderer.attributes_markup/1 builds a HEEx template string by interpolating binary attribute values directly:
{name, val} when is_binary(val) ->
~s|#{name}="#{val}"|
No escaping of " or { is performed. A value such as foo" injected={EXPR} bar=" breaks out of the attribute string and injects EXPR as an inline HEEx expression.
3. Unsandboxed evaluation (component_renderer.ex)
The resulting HEEx string is compiled via EEx.compile_string/2 and evaluated via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox. The injected expression executes on the server even if it causes a rendering error.
/storybook/core_components/button).psb-assign event with an attribute value that escapes the HEEx attribute context and embeds an Elixir expression (e.g. a System.cmd/2 call).No authentication, no special configuration, and no user interaction are required.
This is a pre-authentication remote code execution vulnerability. Any user able to reach the storybook endpoint, including unauthenticated internet users if the storybook is publicly deployed, can execute arbitrary operating system commands with the privileges of the server process. All versions of phoenix_storybook from 0.5.0 before 1.1.0 are affected.
phoenix_storybook >= 0.5.0, < 1.1.0Upgrade to a patched release:
phoenix_storybook 1.1.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14576High· 7.8Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick
CVE-2026-8469HighPhoenixStorybook: Unbounded atom creation from LiveView event params (atom-table DoS)
CVE-2026-47068LowPhoenixStorybook has cross-session PubSub topic injection via URL parameter
CVE-2023-3519Critical· 9.8Unauthenticated remote code execution
CVE-2021-44529Critical· 9.8A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVE-2021-22205Critical· 10.0An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9