A code injection flaw in the Phoenix Storybook WebSocket event handler allows any client to insert arbitrary HEEx template fragments. The framework blindly interpolates attribute values into the template string, so the attacker can close the attribute value and inject an Elixir expression. The injected expression is compiled and executed with full Kernel access, granting the attacker complete control over the server. This represents a classic Code Injection vulnerability (CWE‑94).

The affected product is Phenixdigital Phoenix Storybook, versions 0.5.0 up to but not including 1.1.0.

The CVSS score is 9.5, indicating critical severity. No EPSS score is available, but the lack of a known exploitation probability does not diminish the risk posed by a remote unauthenticated vector. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs network access to the WebSocket endpoint and can trigger the flaw by sending an appropriately crafted psb‑assign event. Because the payload is executed with full kernel imports and no sandbox, the risk of arbitrary code execution is immediate once the exploit is delivered.