Phoenix Storybook - Remote Code Execution
CVE-2026-8467
Verified
Description
Phenixdigital phoenix_storybook >=0.5.0 <1.1.0 contains a code injection caused by unsanitized attribute value interpolation in HEEx template generation, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires sending crafted WebSocket event data.
Severity
Critical
CVSS Score
9.8
Exploit Probability
2%
Published Date
August 31, 2026
Template Author
0x_akoko
CVE-2026-8467.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-8467
CWE ID:
cwe-94
Remediation Steps
Upgrade to version 1.1.0 or later.