CVE-2026-8467EEF-CVE-2026-8467GHSA-55hg-8qxv-qj4p

Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

phenixdigital phoenix_storybookHexLibraries & packages

CVSS

9.5Critical

ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 21 May 2026. Not in the KEV catalogCISA via CVE List

Exploit odds (EPSS)2.11%Chance of exploitation activity in the next 30 days, higher than 81% of CVEs. Scored 27 Oct 2026FIRST EPSS

Fixed in1.1.0Also 56ab8464d4375fa52db806148a06cce126ad481dCVE List

Published20 May 2026Updated 9 Jun 2026CVE List

What fixes it

1.1.0phoenix_storybookCVE List
56ab8464d4375fa52db806148a06cce126ad481dphoenix_storybookCVE List
1.1.0phoenix_storybook, HexOSV

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

20 May 2026, 13:35 UTCPublishedCVE List
27 Oct 2026, 16:51 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

piecar21/CVE-2026-8467: PoC / exploit archive for CVE-2026-8467GitHub proof-of-concept repositories, 27 Oct 2026Exploit code

Description

Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.

The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to 'Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers':handle_set_variation_assign/3, which stores them verbatim. When rendering, 'Elixir.PhoenixStorybook.Rendering.ComponentRenderer':attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name="<val>" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo" injected={EXPR} bar="), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.

This issue affects phoenix_storybook from 0.5.0 before 1.1.0.

Text from CVE List

Affected versions 28

phoenix_storybookaffected: 0.5.0 before 1.1.0CVE List
phoenix_storybookaffected: e35379dfe2ef1a71b141899e36f431017c55265d before 56ab8464d4375fa52db806148a06cce126ad481dCVE List
phoenix_storybook, Hexfrom 0.5.0, fixed in 1.1.0OSV
phoenix_storybook, Hex0.5.0OSV
phoenix_storybook, Hex0.5.1OSV
phoenix_storybook, Hex0.5.2OSV
phoenix_storybook, Hex0.5.3OSV
phoenix_storybook, Hex0.5.4OSV
phoenix_storybook, Hex0.5.5OSV
phoenix_storybook, Hex0.5.6OSV
phoenix_storybook, Hex0.5.7OSV
phoenix_storybook, Hex0.6.0OSV
phoenix_storybook, Hex0.6.1OSV
phoenix_storybook, Hex0.6.2OSV
phoenix_storybook, Hex0.6.3OSV
phoenix_storybook, Hex0.6.4OSV
phoenix_storybook, Hex0.7.0OSV
phoenix_storybook, Hex0.7.1OSV
phoenix_storybook, Hex0.7.2OSV
phoenix_storybook, Hex0.8.0OSV
phoenix_storybook, Hex0.8.1OSV
phoenix_storybook, Hex0.8.2OSV
phoenix_storybook, Hex0.8.3OSV
phoenix_storybook, Hex0.9.0OSV
phoenix_storybook, Hex0.9.1OSV
phoenix_storybook, Hex0.9.2OSV
phoenix_storybook, Hex0.9.3OSV
phoenix_storybook, Hex1.0.0OSV