Vulnerabilities

TI-2026-34670 CVE-2026-47068 · GHSA-mrhx-6pw9-q5fh

Cross-session PubSub topic injection via URL parameter in phoenix_storybook

MEDIUM 51

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00449 Published 2026-05-20 Fixed in 1.1.0 CWE-639

TI-2026-07436 CVE-2026-8467 · GHSA-55hg-8qxv-qj4p

Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

HIGH 82

Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.02111 Published 2026-05-20 Fixed in 1.1.0 CWE-94

TI-2026-07438 CVE-2026-8469 · GHSA-833p-95jq-929q

Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook

HIGH 75

Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00537 Published 2026-05-20 Fixed in 1.1.0 CWE-770

Vulnerabilities

Filters

Cross-session PubSub topic injection via URL parameter in phoenix_storybook

Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook