CVE-2026-8467: phoenix_storybook: unauthenticated code injection (RCE) via HEEx template in playground

Overview

CVE-2026-8467 affects the phoenix_storybook component documentation library from Phenixdigital. According to the record, the playground preview WebSocket handler accepts attribute names and values from unauthenticated clients and places them into a HEEx template without escaping. This is classified as code injection (CWE-94).

Impact

The record states that the flaw allows unauthenticated remote code execution on the server, with the CNA scoring it as critical. The CVSS 4.0 vector in the record indicates network attack vector, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability of the vulnerable system and subsequent systems. The SSVC data in the record lists technical impact as total and automatable as yes.

Affected products and versions

The record lists Phenixdigital Phoenix Storybook with two ranges: versions from 0.5.0 before 1.1.0, and a commit-based range from e35379dfe2ef1a71b141899e36f431017c55265d before 56ab8464d4375fa52db806148a06cce126ad481d.

• Affected range by version: 0.5.0 up to, but not including, 1.1.0.
• Commit-based range as listed in the record.

The record does not provide a separate fixed-version field. The referenced commit 56ab8464d4375fa52db806148a06cce126ad481d is the upper bound of the commit range, and the version boundary 1.1.0 is the upper bound of the version range.

Exploitation status

The CISA KEV entry in the record is not listed. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is recorded as poc, which indicates proof-of-concept availability as reported in the record, not confirmed attacks. The EPSS probability is 0.02059 with a percentile of 0.80817.

Remediation and mitigation

• Upgrade phoenix_storybook to version 1.1.0 or later, which is the version boundary given in the record.
• Review the vendor advisory GHSA-55hg-8qxv-qj4p and the referenced commit for details of the change.
• Until upgrading is possible, restrict network access to development and playground endpoints so that untrusted clients cannot reach the WebSocket interface, and avoid exposing storybook tooling on production or internet-facing hosts.
• Do not rely on the playground being disabled as the only control without confirming it in the deployed configuration.

Detection guidance

• Inventory projects using phoenix_storybook and record the locked version.
• Review web server and application logs for unexpected WebSocket traffic to the playground preview interface from unknown sources.
• Look for unexpected template or compilation errors in storybook rendering as a possible indicator of malformed attribute input.

Limitations of the available information

• The record provides no separate fixed-version field; the fix boundary is inferred from the version range and referenced commit.
• Whether a given deployment exposes the playground publicly is unknown from the record.
• Whether exploitation has occurred in practice is unknown; no confirmed exploitation appears in the sources consulted.
• The CVSS 4.0 vector in the record includes many environmental and threat metrics set to X (not defined), so the base score applies without environmental adjustment.

Frequently asked questions

Is CVE-2026-8467 being actively exploited?

The CISA KEV entry for this CVE is not listed in the record, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is recorded as poc.

Which phoenix_storybook versions are affected?

The record lists versions from 0.5.0 before 1.1.0, plus a commit-based range ending at commit 56ab8464d4375fa52db806148a06cce126ad481d.

What should I do first?

Upgrade phoenix_storybook to 1.1.0 or later, and limit network exposure of the playground and development tooling until the upgrade is done.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.