CVE-2026-8467
CriticalPublic exploitUnauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
Published May 20, 2026 · Updated Oct 8, 2026 · Also known as EEF-CVE-2026-8467, GHSA-55hg-8qxv-qj4p
Key Facts
Patch immediately- CVE-2026-8467 is a critical-severity vulnerability (CVSS 9.5 v4) affecting Phoenix Storybook (Phenixdigital).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 2.1% probability of exploitation in the next 30 days.
- Fixed versions are available, including Phoenix Storybook 1.1.0, Phoenix Storybook 56ab8464d4375fa52db806148a06cce126ad481d.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v4
9.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
2.1%
Higher than 80.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-8467 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.
The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to 'Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers':handle_set_variation_assign/3, which stores them verbatim. When rendering, 'Elixir.PhoenixStorybook.Rendering.ComponentRenderer':attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name="" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo" injected={EXPR} bar="), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.
This issue affects phoenix_storybook from 0.5.0 before 1.1.0.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Phoenix StorybookPhenixdigital | >= 0.5.0 | 1.1.0 |
Patched Releases
Phoenix Storybook
1.1.0, 56ab8464d4375fa52db806148a06cce126ad481d
Timeline
Publicly disclosed
May 20, 2026
Last updated
Oct 8, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8467.json
- advisoryhttps://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-8467
- patchhttps://github.com/phenixdigital/phoenix_storybook/commit/56ab8464d4375fa52db806148a06cce126ad481d
FAQ
Common Questions.
Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.
Affected: Phoenix Storybook (Phenixdigital) versions >= 0.5.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Phoenix Storybook 1.1.0, Phoenix Storybook 56ab8464d4375fa52db806148a06cce126ad481d.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-8467 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo