CVE-2026-8469

CVE-2026-8469 affects phoenix_storybook (0.2.0 before 1.1.0). The issue stems from multiple LiveView handlers that convert user-supplied event strings to BEAM atoms via String.to_atom/1 without validation, causing unbounded atom table growth. BEAM atoms are not garbage-collected; exhaustion of th...

CVE-2026-8469: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenixstorybook allows unauthenticated denial-of-service via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.toatom/1 without...

CVE-2026-47068: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenixstorybook allows cross-session PubSub topic injection via a URL query parameter. 'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handleparams/3 in lib/phoenixstorybook/live/story/componentiframelive.ex read...

CVE-2026-8467: Improper Control of Generation of Code

Code Injection vulnerability in phenixdigital phoenixstorybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation. The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handleevent/3...