Attack Chain

1. Initial Access: An unauthenticated attacker identifies a phoenix_storybook instance running versions between 0.5.0 and 1.0.x (e.g., at /storybook/core_components/button) exposed publicly or internally.
2. WebSocket Connection: The attacker establishes an unauthenticated WebSocket connection to the Phoenix LiveView channel associated with the identified story's Playground tab.
3. Malicious Input: The attacker sends a psb-assign event via the WebSocket. This event contains a crafted attribute value designed to escape the HEEx attribute context and embed arbitrary Elixir expressions.
4. Unsanitized Interpolation: The PhoenixStorybook.Story.PlaygroundPreviewLive component accepts the arbitrary attribute names and values. The ComponentRenderer.attributes_markup/1 function then directly interpolates this unsanitized binary value into a HEEx template string (e.g., ~s|#{name}="#{val}"|).
5. Code Injection: The crafted attribute value uses Elixir's interpolation syntax (e.g., foo" injected={EXPR} bar=") to inject a malicious Elixir expression (EXPR) within the HEEx template, bypassing any escaping.
6. Unsandboxed Compilation: The server compiles the resulting HEEx string (containing the injected Elixir code) via EEx.compile_string/2.
7. Unsandboxed Evaluation: The compiled code is then evaluated using Code.eval_quoted_with_env/3 with full Kernel imports and no sandboxing, allowing the malicious Elixir expression to execute.
8. Remote Code Execution: The injected Elixir expression, typically a System.cmd/2 call (e.g., System.cmd("bash", ["-c", "whoami"])), executes arbitrary operating system commands on the server with the privileges of the Elixir application process, leading to full system compromise.

Impact

This pre-authentication remote code execution vulnerability allows any unauthenticated user who can reach the phoenix_storybook endpoint to execute arbitrary operating system commands. If the storybook is publicly exposed, internet-facing systems are vulnerable to complete compromise. Successful exploitation grants the attacker full control over the affected server, enabling data exfiltration, deployment of further malware, persistence mechanisms, or integration into botnets. All versions of phoenix_storybook from 0.5.0 before 1.1.0 are vulnerable, potentially impacting a wide range of Elixir applications leveraging this library.

Recommendation

• Immediately patch phoenix_storybook to version 1.1.0 or later to address CVE-2026-8467.
• Deploy the provided Sigma rules to your SIEM and tune for your environment to detect post-exploitation activity resulting from CVE-2026-8467.
• Implement strict network segmentation to restrict access to development/storybook environments, ensuring they are not publicly exposed.
• Enable comprehensive process_creation logging on Linux servers running Elixir applications, specifically monitoring for unusual child processes spawned by the beam.smp process.