Skip to content
Threat Feed
Subscribe

Product

Phoenix_storybook (>= 0.5.0, < 1.1.0)

1 brief RSS
critical advisory

Critical Unauthenticated RCE in PhoenixStorybook via HEEx Template Injection (CVE-2026-8467)

A critical unauthenticated remote code execution vulnerability (CVE-2026-8467) in Phenix Digital's `phoenix_storybook` versions 0.5.0 through 1.0.x allows attackers to inject arbitrary Elixir code via unsanitized WebSocket input, leading to OS command execution.

PoC phoenix_storybook rce web-vulnerability elixir phoenix websocket template-injection linux
2r 5t 1c updated