This vulnerability (CVE-2026-8469) in phenixdigital phoenix_storybook (versions before 1.1.0) is due to unsafe conversion of user-controlled strings to BEAM atoms in multiple LiveView event handlers without validation or throttling. The functions involved intern atoms from user input parameters such as psb-assign map keys, psb-toggle event attributes, variation_id elements, and raw string values for attributes declared as :atom or :boolean. Because BEAM atoms are not garbage-collected, an attacker can exhaust the atom table by supplying many unique strings, causing the BEAM node to abort and resulting in denial-of-service. The vulnerability has a CVSS 4.0 score of 8.2 (high severity) and affects version 0.2.0 of phoenix_storybook. No patch or official remediation is currently documented.

An unauthenticated attacker can cause a denial-of-service condition by exhausting the BEAM atom table through repeated submission of unique strings that are converted to atoms. This leads to the BEAM node aborting, which crashes all applications running on that node. This impacts availability severely but does not indicate direct code execution or data disclosure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints or implementing rate limiting on inputs that lead to atom creation. Avoid exposing the vulnerable LiveView event handlers to untrusted users if possible. Monitor vendor communications for updates and apply official patches once released.