CVE-2026-8467
Unauthenticated remote code execution via HEEx template injection in Phoenix Storybook
The phoenix_storybook library lets unauthenticated attackers run arbitrary server code by injecting malicious attribute values into HEEx templates, the HTML templating language used by Phoenix, which are then compiled and executed as Elixir. Versions 0.5.0 before 1.1.0 are affected, with fixes in commit 56ab8464 and version 1.1.0. CISA has a proof of concept but does not list this as known-exploited.
phenixdigital phoenix_storybook · Updated 28 Oct · From 1 of our story and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.5 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| phoenix_storybook 56ab8464d4375fa52db806148a06cce126ad481d | 56ab8464d4375fa52db806148a06cce126ad481d |
| phoenix_storybook 1.1 | 1.1.0 |
What to do
- Upgrade phoenix_storybook to version 1.1.0 or to commit 56ab8464d4375fa52db806148a06cce126ad481d.
- If you cannot upgrade immediately, remove or disable the storybook playground in production so unauthenticated users cannot reach it.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-8467 | Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground | critical 9.5 | No | 2.1% |
Our reporting
27 OctBrazilian skimming gang compromises Convertr analytics script, steals payment card dataReported elsewhere
BleepingComputer · 27 OctHackers hijack Convertr analytics script to steal payment card data ↗The records
github.com: advisory ↗github.com: advisory ↗CVE-2026-8467 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works