The vulnerability exists in the psb-assign WebSocket event handler within 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3, which accepts arbitrary attribute names and values from unauthenticated clients. These values are stored verbatim by 'Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers':handle_set_variation_assign/3. During rendering, 'Elixir.PhoenixStorybook.Rendering.ComponentRenderer':attributes_markup/1 interpolates these values directly into HEEx template strings as name="<val>" without escaping double quotes or HEEx expression delimiters. An attacker can craft a value containing a closing quote followed by a HEEx expression block, causing the expression to be compiled and executed with full privileges via EEx.compile_string/2 and Code.eval_quoted_with_env/3. This results in unauthenticated remote code execution on the server hosting phoenix_storybook versions prior to 1.1.0.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server with full Kernel imports and no sandbox restrictions. This can lead to complete compromise of the affected system, including data theft, service disruption, or further network penetration. The CVSS 4.0 base score is 9.5, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, avoid exposing the vulnerable phoenix_storybook versions to untrusted networks or unauthenticated users. Monitor vendor communications for updates on remediation. Do not rely on generic mitigations as the vulnerability specifically involves unsanitized HEEx template interpolation.