Phoenix Storybook Cross-session PubSub Injection Vulnerability (CVE-2026-47068)

Vulnerability Summary: EEF-CVE-2026-47068 Overview Vulnerability Name: Cross-session PubSub topic injection via URL parameter in phoenix_storybook Vulnerability Type: Authorization Bypass Through User-Controlled Key CVSS Score: 2.3 (Low) Affected Component: Description: In , the function of reads the from URL parameters and broadcasts it to the without verifying whether the topic belongs to the requesting session. The shared is used to coordinate in the playground; each playground subscribes to a session-specific topic and uses the received iframe PID to send subsequent control messages (e.g., status, theme toggles, extra payloads). An attacker can load , causing the victim’s playground to send private messages to the attacker’s iframe process. Impact Scope Affected Versions: - through (inclusive) - All versions Package Name: Purl: Remediation Fix Status: No specific patched version or patch information provided. Recommendations: - Upgrade to the patched version (if available). - Temporary Mitigation: Avoid passing untrusted values in URL parameters; strictly validate and filter inputs. - Monitor logs for abnormal iframe loading behavior. References GitHub Advisory: https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrxx-6w9f-q5fh CNA CVE Page: https://cna.ariel.org/cves/EEF-CVE-2026-47068.html Commit Fix: https://github.com/phenixdigital/phoenix_storybook/commit/6ee03fc738d4436dede1b66cd5c80663d489f5 Hex Package: https://hex.pm/packages/phoenix_storybook Credits Peter Ullrich - FINDER Christian Blavier - REMEDIATION_DEVELOPER Jonatan Männchen - ANALYST > Note: The page does not provide POC code or exploit code blocks.

Goal Reached Thanks to every supporter — we hit 100%!

Phoenix Storybook Cross-session PubSub Injection Vulnerability (CVE-2026-47068)