The vulnerability in phenixdigital phoenix_storybook (versions before 1.1.0) arises from multiple LiveView event handlers converting user-supplied event parameter strings into BEAM atoms using String.to_atom/1 without validation or throttling. Since BEAM atoms are permanent and not garbage-collected, each unique string permanently consumes an atom table entry. When the atom table limit (~1,048,576 atoms) is reached, the BEAM node crashes, causing a denial-of-service. This affects handlers such as handle_set_variation_assign/3, handle_toggle_variation_assign/3, to_variation_id/2, and to_value/4 within the ExtraAssignsHelpers module.

An unauthenticated attacker can cause a denial-of-service by exhausting the BEAM atom table through repeated submission of unique strings that are converted to atoms. This leads to the BEAM node aborting and taking down all applications running on it. The impact is high as it results in complete service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing vulnerable versions of phoenix_storybook to untrusted users or inputs that could trigger atom table exhaustion. Monitor for updates from phenixdigital regarding patches or official mitigations.