{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/phenix-digital/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:phenix_digital:phoenix_storybook:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-8467"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=60FB9B88-DD24-5D67-8993-58795FA94321\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["phoenix_storybook (\u003e= 0.5.0, \u003c 1.1.0)"],"_cs_severities":["critical"],"_cs_tags":["rce","web-vulnerability","elixir","phoenix","websocket","template-injection","linux"],"_cs_type":"advisory","_cs_vendors":["Phenix Digital"],"content_html":"\u003cp\u003eA critical unauthenticated remote code execution vulnerability, identified as CVE-2026-8467, affects Phenix Digital's \u003ccode\u003ephoenix_storybook\u003c/code\u003e library, specifically versions from 0.5.0 up to, but not including, 1.1.0. This flaw lies within the \u003ccode\u003ephoenix_storybook\u003c/code\u003e playground's handling of HEEx templates, allowing unauthenticated attackers to inject arbitrary Elixir code into a server-side template. The vulnerability leverages unsanitized user-controlled attributes passed via WebSocket connections, leading to direct code execution with full \u003ccode\u003eKernel\u003c/code\u003e access. This permits attackers to execute arbitrary operating system commands on the compromised server. The vulnerability requires no authentication or special configuration, making it highly exploitable, especially if the storybook interface is exposed publicly. This poses a severe risk to organizations using affected versions, enabling complete system compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: An unauthenticated attacker identifies a \u003ccode\u003ephoenix_storybook\u003c/code\u003e instance running versions between 0.5.0 and 1.0.x (e.g., at \u003ccode\u003e/storybook/core_components/button\u003c/code\u003e) exposed publicly or internally.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eWebSocket Connection\u003c/strong\u003e: The attacker establishes an unauthenticated WebSocket connection to the Phoenix LiveView channel associated with the identified story's Playground tab.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious Input\u003c/strong\u003e: The attacker sends a \u003ccode\u003epsb-assign\u003c/code\u003e event via the WebSocket. This event contains a crafted attribute value designed to escape the HEEx attribute context and embed arbitrary Elixir expressions.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUnsanitized Interpolation\u003c/strong\u003e: The \u003ccode\u003ePhoenixStorybook.Story.PlaygroundPreviewLive\u003c/code\u003e component accepts the arbitrary attribute names and values. The \u003ccode\u003eComponentRenderer.attributes_markup/1\u003c/code\u003e function then directly interpolates this unsanitized binary value into a HEEx template string (e.g., \u003ccode\u003e~s|#{name}=\u0026quot;#{val}\u0026quot;|\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCode Injection\u003c/strong\u003e: The crafted attribute value uses Elixir's interpolation syntax (e.g., \u003ccode\u003efoo\u0026quot; injected={EXPR} bar=\u0026quot;\u003c/code\u003e) to inject a malicious Elixir expression (\u003ccode\u003eEXPR\u003c/code\u003e) within the HEEx template, bypassing any escaping.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUnsandboxed Compilation\u003c/strong\u003e: The server compiles the resulting HEEx string (containing the injected Elixir code) via \u003ccode\u003eEEx.compile_string/2\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUnsandboxed Evaluation\u003c/strong\u003e: The compiled code is then evaluated using \u003ccode\u003eCode.eval_quoted_with_env/3\u003c/code\u003e with full \u003ccode\u003eKernel\u003c/code\u003e imports and no sandboxing, allowing the malicious Elixir expression to execute.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRemote Code Execution\u003c/strong\u003e: The injected Elixir expression, typically a \u003ccode\u003eSystem.cmd/2\u003c/code\u003e call (e.g., \u003ccode\u003eSystem.cmd(\u0026quot;bash\u0026quot;, [\u0026quot;-c\u0026quot;, \u0026quot;whoami\u0026quot;])\u003c/code\u003e), executes arbitrary operating system commands on the server with the privileges of the Elixir application process, leading to full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis pre-authentication remote code execution vulnerability allows any unauthenticated user who can reach the \u003ccode\u003ephoenix_storybook\u003c/code\u003e endpoint to execute arbitrary operating system commands. If the storybook is publicly exposed, internet-facing systems are vulnerable to complete compromise. Successful exploitation grants the attacker full control over the affected server, enabling data exfiltration, deployment of further malware, persistence mechanisms, or integration into botnets. All versions of \u003ccode\u003ephoenix_storybook\u003c/code\u003e from 0.5.0 before 1.1.0 are vulnerable, potentially impacting a wide range of Elixir applications leveraging this library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch \u003ccode\u003ephoenix_storybook\u003c/code\u003e to version 1.1.0 or later to address CVE-2026-8467.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rules to your SIEM and tune for your environment to detect post-exploitation activity resulting from CVE-2026-8467.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation to restrict access to development/storybook environments, ensuring they are not publicly exposed.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive \u003ccode\u003eprocess_creation\u003c/code\u003e logging on Linux servers running Elixir applications, specifically monitoring for unusual child processes spawned by the \u003ccode\u003ebeam.smp\u003c/code\u003e process.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T18:15:36Z","date_published":"2026-06-14T13:33:49Z","id":"https://feed.craftedsignal.io/briefs/2026-06-phoenixstorybook-rce/","summary":"A critical unauthenticated remote code execution vulnerability (CVE-2026-8467) in Phenix Digital's `phoenix_storybook` versions 0.5.0 through 1.0.x allows attackers to inject arbitrary Elixir code via unsanitized WebSocket input, leading to OS command execution.","title":"Critical Unauthenticated RCE in PhoenixStorybook via HEEx Template Injection (CVE-2026-8467)","url":"https://feed.craftedsignal.io/briefs/2026-06-phoenixstorybook-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Phenix Digital","version":"https://jsonfeed.org/version/1.1"}