Code Injection Vulnerability in Phoenix Storybook by Phenix Digital

CVE-2026-8467

What is CVE-2026-8467?

A vulnerability exists in Phenix Digital's Phoenix Storybook that allows unauthenticated remote code execution due to unsanitized attribute value interpolation during HEEx template generation. The psb-assign WebSocket event handler permits arbitrary attribute names and values from unauthenticated clients. When these values are rendered, they are interpolated directly into a HEEx template string, posing a risk for an attacker to execute arbitrary code on the server by supplying a value with a closing quote followed by a HEEx expression block. This vulnerability affects versions from 0.5.0 before 1.1.0, highlighting the need for immediate awareness and patching.

References