Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-47068— Cross-session PubSub topic injection via URL parameter in phoenix_storybook

Quick assessment

Affected
phenixdigital phoenix_storybook
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PhoenixStorybook是Phenix Digital开源的一个组件展示与交互调试的UI工具。 PhoenixStorybook 0.4.0至1.1.0之前版本存在安全漏洞，该漏洞源于通过用户控制密钥绕过授权，攻击者可通过URL查询参数注入跨会话PubSub主题。

AI Predicted 9.8 Difficulty: Easy EPSS 0.53% · P43

Affected Version Matrix 2

VendorProduct Version RangeStatus
phenixdigital phoenix_storybook 0.4.0< 1.1.0 affected
8c2c97b0f505780fee4069988bf86736f51d35d7< 6ee03f1c738d4436dde1b066cf65c80663d489f5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-47068

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-session PubSub topic injection via URL parameter in phoenix_storybook
Source: CVE Program / CVE List V5
Vulnerability Description
Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter. 'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params["topic"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process. This issue affects phoenix_storybook from 0.4.0 before 1.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
PhoenixStorybook 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PhoenixStorybook是Phenix Digital开源的一个组件展示与交互调试的UI工具。 PhoenixStorybook 0.4.0至1.1.0之前版本存在安全漏洞，该漏洞源于通过用户控制密钥绕过授权，攻击者可通过URL查询参数注入跨会话PubSub主题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
phenixdigital phoenix_storybook 0.4.0 ~ 1.1.0 cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*
phenixdigital phoenix_storybook 8c2c97b0f505780fee4069988bf86736f51d35d7 ~ 6ee03f1c738d4436dde1b066cf65c80663d489f5 cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-47068

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-47068

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-47068 (1)

Vendor Advisories for CVE-2026-47068 (3)

Same Patch Batch · phenixdigital · 2026-05-20 · 3 CVEs total

CVE-2026-8469 Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook
CVE-2026-8467 Unauthenticated remote code execution via HEEx template injection in phoenix_storybook pla

IV. Related Vulnerabilities

Same product: phoenix_storybook
Same vendor: phenixdigital
Same weakness: CWE-639

V. Comments for CVE-2026-47068

No comments yet

Leave a comment