Executive brief
A vulnerability in Phoenix Storybook, a tool used to showcase and test UI components in Elixir applications, allows an unauthenticated attacker to crash the entire server. By sending specially crafted requests to the Storybook interface, an attacker can exhaust the system's memory reserved for internal identifiers (atoms). This results in a complete service outage for the affected application and any other services running on the same server node.
Technical details
The vulnerability exists in `PhoenixStorybook.Story.Playground` and `PhoenixStorybook.ExtraAssignsHelpers` due to the use of `String.to_atom/1` on user-supplied event parameters. Specifically, event handlers like `psb-assign` and `psb-toggle` iterate through client-provided maps and intern keys or values as atoms without validation. In the Erlang VM (BEAM), atoms are not garbage-collected and have a hard limit (default ~1.04M). An unauthenticated remote attacker can reach the Storybook route and send a stream of unique strings to exhaust this table, causing the VM to abort. The issue is fixed in version 1.1.0 by using `String.to_existing_atom/1` or validating against a registry of known attributes.
Affected products
- phenixdigital phoenix_storybook >= 0.2.0, < 1.1.0
Timeline
- 2026-05-20: disclosed
- 2026-06-09: advisory: GitHub Advisory published
- 2026-06-09: patched