Most recent entries from all

EUVD-2026-322097

fkie_cve-2026-8467

Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.

The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to 'Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers':handle_set_variation_assign/3, which stores them verbatim. When rendering, 'Elixir.PhoenixStorybook.Rendering.ComponentRenderer':attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name="<val>" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo" injected={EXPR} bar="), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.

This issue affects phoenix_storybook from 0.5.0 before 1.1.0.

GHSA-55hg-8qxv-qj4p — PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

Affected: Hex: phoenix_storybook

### Summary An unsafe HEEx template generation vulnerability allows any unauthenticated user to execute arbitrary code on the server. The phoenix_storybook playground accepts user-controlled attribute values over WebSocket and interpolates them unsanitized into a HEEx template that is subsequently compiled and evaluated with full Elixir `Kernel` access.

### Details The vulnerability is a three-step chain:

**1. Unsanitized WebSocket input (`extra_assigns_helpers.ex`)** The `psb-assign` event handler in `PhoenixStorybook.Story.PlaygroundPreviewLive` accepts arbitrary attribute names and values from unauthenticated WebSocket clients and stores them verbatim via `ExtraAssignsHelpers.handle_set_variation_assign/3`.

**2. Unescaped interpolation into HEEx (`component_renderer.ex`)** `ComponentRenderer.attributes_markup/1` builds a HEEx template string by interpolating binary attribute values directly: ```elixir {name, val} when is_binary(val) -> ~s|#{name}="#{val}"| ``` No escaping of `"` or `{` is performed. A value such as `foo" injected={EXPR} bar="` breaks out of the attribute string and injects `EXPR` as an inline HEEx expression.

**3. Unsandboxed evaluation (`component_renderer.ex`)** The resulting HEEx string is compiled via `EEx.compile_string/2` and evaluated via `Code.eval_quoted_with_env/3` with full `Kernel` imports and no sandbox. The injected expression executes on the server even if it causes a rendering error.

### PoC 1. Identify any story URL with a Playgro…