CVE-2026-8467: RCE in PhoenixStorybook via HEEx Template Injection

Code injection in Phoenix 0.5.0-1.1.0 enables unauthenticated RCE via HEEx templates. CVSS 9.5. Update.

CVE-2026-8467 is a code injection vulnerability in phoenix_storybook enabling unauthenticated RCE. The flaw: the 'psb-assign' WebSocket handler accepts arbitrary attribute values from unauthenticated clients, which are interpolated directly into HEEx template strings without proper escaping of quotes or delimiters. Affects versions 0.5.0 through 1.0.x. An attacker compromises the server with Elixir process privileges, without prior authentication.

CVSS 9.5 (critical). The official NVD description (May 2026) documents the complete flow: unsanitized values are compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel access and no sandbox. Patch available since May in version 1.1.0+. Recent social signals indicate active discussion of the vulnerability, suggesting prolonged exposure for those who have not updated.

Defense actions: 1) Inventory assets running phoenix_storybook versions 0.5.0-1.0.x with critical priority. 2) Plan upgrade to 1.1.0+ within days, not weeks. 3) Review WebSocket logs for injection attempts in attribute parameters. 4) If upgrade blocked by dependency constraints, isolate vulnerable servers on separate networks or disable storybook component access. The only reliable mitigation is package update.

At a glance

What: Code injection in phoenix_storybook via unsanitized attribute value interpolation in HEEx template generation. The 'psb-assign' WebSocket handler accepts arbitrary attribute values from unauthenticated clients, which are interpolated without escaping into the HEEx template string and compiled/executed as Elixir code with full Kernel access.
Severity: CVSS 9.5 critical. Enables arbitrary code execution on the server with Elixir process privileges, without authentication. Complete impact on confidentiality, integrity, and availability.
Affected versions: phoenix_storybook from version 0.5.0 to (excluding) 1.1.0. Versions 1.1.0 and later include the fix.
Fix: Update phoenix_storybook to version 1.1.0 or later. The fix implements proper escaping of attribute values and input validation in the HEEx template rendering workflow.
Status: Vulnerability confirmed and patch released. CVE published by NVD on 2026-05-20. Social signals indicate active discussion of the vulnerability (October 2026).
Action: 1. Verify inventory for phoenix_storybook versions 0.5.0-1.0.x with critical priority. 2. Plan upgrade to 1.1.0+ within days. 3. Review WebSocket access logs during vulnerable period. 4. If upgrade not possible in short term, isolate assets or disable storybook access.

Sources: NVD, CVE-2026-8467

← All articles