https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 13:31:00 +0000 https://cve.radiocsirt.org/vuln/cve-2026-8467 <p><strong>Affected:</strong> phenixdigital phoenix_storybook</p> <p>Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.</p> <p>The psb-assign WebSocket event handler in &#39;Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive&#39;:handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to &#39;Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers&#39;:handle_set_variation_assign/3, which stores them verbatim. When rendering, &#39;Elixir.PhoenixStorybook.Rendering.ComponentRenderer&#39;:attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name=&#34;&lt;val&gt;&#34; without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo&#34; injected={EXPR} bar=&#34;), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.</p> <p>This issue affects phoenix_storybook from 0.5.0 before 1.1.0.</p> <p><strong>Affected:</strong> phenixdigital phoenix_storybook</p> <p>Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.</p> <p>The psb-assign WebSocket event handler in &#39;Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive&#39;:handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to &#39;Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers&#39;:handle_set_variation_assign/3, which stores them verbatim. When rendering, &#39;Elixir.PhoenixStorybook.Rendering.ComponentRenderer&#39;:attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name=&#34;&lt;val&gt;&#34; without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo&#34; injected={EXPR} bar=&#34;), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.</p> <p>This issue affects phoenix_storybook from 0.5.0 before 1.1.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-8467