PhoenixStorybook: Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

Summary

An unsafe HEEx template generation vulnerability allows any unauthenticated user to execute arbitrary code on the server. The phoenix_storybook playground accepts user-controlled attribute values over WebSocket and interpolates them unsanitized into a HEEx template that is subsequently compiled and evaluated with full Elixir Kernel access.

Details

The vulnerability is a three-step chain:

1. Unsanitized WebSocket input (extra_assigns_helpers.ex) The psb-assign event handler in PhoenixStorybook.Story.PlaygroundPreviewLive accepts arbitrary attribute names and values from unauthenticated WebSocket clients and stores them verbatim via ExtraAssignsHelpers.handle_set_variation_assign/3.

2. Unescaped interpolation into HEEx (component_renderer.ex) ComponentRenderer.attributes_markup/1 builds a HEEx template string by interpolating binary attribute values directly:

{name, val} when is_binary(val) ->
  ~s|#{name}="#{val}"|

No escaping of " or { is performed. A value such as foo" injected={EXPR} bar=" breaks out of the attribute string and injects EXPR as an inline HEEx expression.

3. Unsandboxed evaluation (component_renderer.ex) The resulting HEEx string is compiled via EEx.compile_string/2 and evaluated via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox. The injected expression executes on the server even if it causes a rendering error.

PoC

1. Identify any story URL with a Playground tab (e.g. /storybook/core_components/button).
2. Connect to the Phoenix LiveView WebSocket without any authentication.
3. Join the story's LiveView channel and send a psb-assign event with an attribute value that escapes the HEEx attribute context and embeds an Elixir expression (e.g. a System.cmd/2 call).
4. The server evaluates the injected expression and returns its output in the rendered response.