Executive brief
PhoenixStorybook, a library for documenting Elixir Phoenix components, contains a vulnerability that allows an attacker to hijack communication between a user's browser and the server. By guessing a specific session identifier, an unauthenticated attacker can redirect private control messages and component data to their own session. This could lead to the exposure of sensitive UI state or theme information across different user sessions.
Technical details
The vulnerability exists in `PhoenixStorybook.Story.ComponentIframeLive.handle_params/3`, which accepts a PubSub topic directly from the `topic` URL query parameter without verifying session ownership. When a user visits a crafted URL, the iframe LiveView broadcasts its process ID (PID) to the attacker-supplied topic. A victim's playground subscribed to that topic will then send subsequent state and control messages (such as variation state and theme switches) to the attacker's process instead of the legitimate iframe. This results in a cross-session information leak and message injection. The issue is fixed in version 1.1.0 by deriving the topic from the server-side session.
Affected products
- phenixdigital phoenix_storybook >= 0.4.0, < 1.1.0
Timeline
- 2026-05-20: advisory: GitHub Advisory published
- 2026-06-09: patched: Version 1.1.0 released