CVE-2026-8467
A code injection flaw in Phoenix Storybook lets attackers run arbitrary code on the server by sending specially crafted data to a WebSocket event. The vulnerability occurs because attribute values are inserted into a template without escaping, allowing Elixir expressions to be injected. It affects versions 0.5.0 through before 1.1.0 and is fixed in 1.1.0 or later.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Phoenix Storybook versions 0.5.0 up to, but not including, 1.1.0 – used by developers building Elixir/Phoenix applications.
Real-world impact
An attacker could execute any code on the server, potentially taking full control of the host, exfiltrating data, or installing malware.
Why this severity
The CVSS score of 9.5 reflects the vulnerability’s high impact (remote code execution with no authentication required) and the fact that it can be exploited by sending crafted data to a public WebSocket endpoint.
What to do about it
- 01Upgrade Phoenix Storybook to version 1.1.0 or later.
- 02Restart the application to load the new version.
NVD description
Timeline
- May 20, 2026 · May 20, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.