Critical Unauthenticated RCE in PhoenixStorybook via HEEx Template Injection (CVE-2026-8467)

A critical unauthenticated remote code execution vulnerability, identified as CVE-2026-8467, affects Phenix Digital's phoenix_storybook library, specifically versions from 0.5.0 up to, but not including, 1.1.0. This flaw lies within the phoenix_storybook playground's handling of HEEx templates, allowing unauthenticated attackers to inject arbitrary Elixir code into a server-side template. The vulnerability leverages unsanitized user-controlled attributes passed via WebSocket connections, leading to direct code execution with full Kernel access. This permits attackers to execute arbitrary operating system commands on the compromised server. The vulnerability requires no authentication or special configuration, making it highly exploitable, especially if the storybook interface is exposed publicly. This poses a severe risk to organizations using affected versions, enabling complete system compromise.

Attack Chain

1. Initial Access: An unauthenticated attacker identifies a phoenix_storybook instance running versions between 0.5.0 and 1.0.x (e.g., at /storybook/core_components/button) exposed publicly or internally.
2. WebSocket Connection: The attacker establishes an unauthenticated WebSocket connection to the Phoenix LiveView channel associated with the identified story's Playground tab.
3. Malicious Input: The attacker sends a psb-assign event via the WebSocket. This event contains a crafted attribute value designed to escape the HEEx attribute context and embed arbitrary Elixir expressions.
4. Unsanitized Interpolation: The PhoenixStorybook.Story.PlaygroundPreviewLive component accepts the arbitrary attribute names and values. The ComponentRenderer.attributes_markup/1 function then directly interpolates this unsanitized binary value into a HEEx template string (e.g., ~s|#{name}="#{val}"|).
5. Code Injection: The crafted attribute value uses Elixir's interpolation syntax (e.g., foo" injected={EXPR} bar=") to inject a malicious Elixir expression (EXPR) within the HEEx template, bypassing any escaping.
6. Unsandboxed Compilation: The server compiles the resulting HEEx string (containing the injected Elixir code) via EEx.compile_string/2.
7. Unsandboxed Evaluation: The compiled code is then evaluated using Code.eval_quoted_with_env/3 with full Kernel imports and no sandboxing, allowing the malicious Elixir expression to execute.
8. Remote Code Execution: The injected Elixir expression, typically a System.cmd/2 call (e.g., System.cmd("bash", ["-c", "whoami"])), executes arbitrary operating system commands on the server with the privileges of the Elixir application process, leading to full system compromise.

Impact

This pre-authentication remote code execution vulnerability allows any unauthenticated user who can reach the phoenix_storybook endpoint to execute arbitrary operating system commands. If the storybook is publicly exposed, internet-facing systems are vulnerable to complete compromise. Successful exploitation grants the attacker full control over the affected server, enabling data exfiltration, deployment of further malware, persistence mechanisms, or integration into botnets. All versions of phoenix_storybook from 0.5.0 before 1.1.0 are vulnerable, potentially impacting a wide range of Elixir applications leveraging this library.

Recommendation

• Immediately patch phoenix_storybook to version 1.1.0 or later to address CVE-2026-8467.
• Deploy the provided Sigma rules to your SIEM and tune for your environment to detect post-exploitation activity resulting from CVE-2026-8467.
• Implement strict network segmentation to restrict access to development/storybook environments, ensuring they are not publicly exposed.
• Enable comprehensive process_creation logging on Linux servers running Elixir applications, specifically monitoring for unusual child processes spawned by the beam.smp process.