CVE-2026-47068

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47068", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-18T17:28:08.321Z", "datePublished": "2026-05-20T13:35:33.215Z", "dateUpdated": "2026-05-27T15:41:37.339Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.PhoenixStorybook.Story.ComponentIframeLive'"], "packageName": "phoenix_storybook", "packageURL": "pkg:hex/phoenix_storybook", "product": "phoenix_storybook", "programFiles": ["lib/phoenix_storybook/live/story/component_iframe_live.ex"], "programRoutines": [{"name": "'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3"}], "repo": "https://github.com/phenixdigital/phoenix_storybook", "vendor": "phenixdigital", "versions": [{"lessThan": "1.1.0", "status": "affected", "version": "0.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.PhoenixStorybook.Story.ComponentIframeLive'"], "packageName": "phenixdigital/phoenix_storybook", "packageURL": "pkg:github/phenixdigital/phoenix_storybook", "product": "phoenix_storybook", "programFiles": ["lib/phoenix_storybook/live/story/component_iframe_live.ex"], "programRoutines": [{"name": "'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3"}], "repo": "https://github.com/phenixdigital/phoenix_storybook", "vendor": "phenixdigital", "versions": [{"lessThan": "6ee03f1c738d4436dde1b066cf65c80663d489f5", "status": "affected", "version": "8c2c97b0f505780fee4069988bf86736f51d35d7", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.1.0", "versionStartIncluding": "0.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Christian Blavier"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.</p><p><tt>'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3</tt> in <tt>lib/phoenix_storybook/live/story/component_iframe_live.ex</tt> reads a PubSub topic directly from <tt>params[\"topic\"]</tt> and broadcasts <tt>{:component_iframe_pid, self()}</tt> on it with no check that the topic belongs to the requesting session. The shared <tt>PhoenixStorybook.PubSub</tt> is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via <tt>send/2</tt>. Because the iframe trusts the query parameter, an attacker who loads <tt>/storybook/iframe/&lt;story&gt;?topic=&lt;victim_topic&gt;</tt> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.</p><p>This issue affects phoenix_storybook from 0.4.0 before 1.1.0.</p>"}], "value": "Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\n\n'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params[\"topic\"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.\n\nThis issue affects phoenix_storybook from 0.4.0 before 1.1.0."}], "impacts": [{"capecId": "CAPEC-12", "descriptions": [{"lang": "en", "value": "CAPEC-12 Choosing Message Identifier"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 2.3, "baseSeverity": "LOW", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-27T15:41:37.339Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-47068.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47068"}, {"tags": ["patch"], "url": "https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5"}], "source": {"discovery": "EXTERNAL"}, "title": "Cross-session PubSub topic injection via URL parameter in phoenix_storybook", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-21T13:59:23.206364Z", "id": "CVE-2026-47068", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T13:59:48.062Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47068", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T13:59:23.206364Z"}}}], "references": [{"url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-21T13:59:42.850Z"}}], "cna": {"title": "Cross-session PubSub topic injection via URL parameter in phoenix_storybook", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Christian Blavier"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-12", "descriptions": [{"lang": "en", "value": "CAPEC-12 Choosing Message Identifier"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"], "repo": "https://github.com/phenixdigital/phoenix_storybook", "vendor": "phenixdigital", "modules": ["'Elixir.PhoenixStorybook.Story.ComponentIframeLive'"], "product": "phoenix_storybook", "versions": [{"status": "affected", "version": "0.4.0", "lessThan": "1.1.0", "versionType": "semver"}], "packageURL": "pkg:hex/phoenix_storybook", "packageName": "phoenix_storybook", "programFiles": ["lib/phoenix_storybook/live/story/component_iframe_live.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3"}]}, {"cpes": ["cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"], "repo": "https://github.com/phenixdigital/phoenix_storybook", "vendor": "phenixdigital", "modules": ["'Elixir.PhoenixStorybook.Story.ComponentIframeLive'"], "product": "phoenix_storybook", "versions": [{"status": "affected", "version": "8c2c97b0f505780fee4069988bf86736f51d35d7", "lessThan": "6ee03f1c738d4436dde1b066cf65c80663d489f5", "versionType": "git"}], "packageURL": "pkg:github/phenixdigital/phoenix_storybook", "packageName": "phenixdigital/phoenix_storybook", "programFiles": ["lib/phoenix_storybook/live/story/component_iframe_live.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3"}]}], "references": [{"url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-47068.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47068", "tags": ["related"]}, {"url": "https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\n\n'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params[\"topic\"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.\n\nThis issue affects phoenix_storybook from 0.4.0 before 1.1.0.", "supportingMedia": [{"type": "text/html", "value": "<p>Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.</p><p><tt>'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3</tt> in <tt>lib/phoenix_storybook/live/story/component_iframe_live.ex</tt> reads a PubSub topic directly from <tt>params[\"topic\"]</tt> and broadcasts <tt>{:component_iframe_pid, self()}</tt> on it with no check that the topic belongs to the requesting session. The shared <tt>PhoenixStorybook.PubSub</tt> is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via <tt>send/2</tt>. Because the iframe trusts the query parameter, an attacker who loads <tt>/storybook/iframe/&lt;story&gt;?topic=&lt;victim_topic&gt;</tt> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.</p><p>This issue affects phoenix_storybook from 0.4.0 before 1.1.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.1.0", "versionStartIncluding": "0.4.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-27T15:41:37.339Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47068", "state": "PUBLISHED", "dateUpdated": "2026-05-27T15:41:37.339Z", "dateReserved": "2026-05-18T17:28:08.321Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-05-20T13:35:33.215Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.PhoenixStorybook.Story.ComponentIframeLive'"], "packageName": "phoenix_storybook", "packageURL": "pkg:hex/phoenix_storybook", "product": "phoenix_storybook", "programFiles": ["lib/phoenix_storybook/live/story/component_iframe_live.ex"], "programRoutines": [{"name": "'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3"}], "repo": "https://github.com/phenixdigital/phoenix_storybook", "vendor": "phenixdigital", "versions": [{"lessThan": "1.1.0", "status": "affected", "version": "0.4.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.PhoenixStorybook.Story.ComponentIframeLive'"], "packageName": "phenixdigital/phoenix_storybook", "packageURL": "pkg:github/phenixdigital/phoenix_storybook", "product": "phoenix_storybook", "programFiles": ["lib/phoenix_storybook/live/story/component_iframe_live.ex"], "programRoutines": [{"name": "'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3"}], "repo": "https://github.com/phenixdigital/phoenix_storybook", "vendor": "phenixdigital", "versions": [{"lessThan": "6ee03f1c738d4436dde1b066cf65c80663d489f5", "status": "affected", "version": "8c2c97b0f505780fee4069988bf86736f51d35d7", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\n\n'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params[\"topic\"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process.\n\nThis issue affects phoenix_storybook from 0.4.0 before 1.1.0."}, {"lang": "es", "value": "Vulnerabilidad de elusi\u00f3n de autorizaci\u00f3n mediante clave controlada por el usuario en phenixdigital phoenix_storybook permite la inyecci\u00f3n de temas PubSub entre sesiones a trav\u00e9s de un par\u00e1metro de consulta de URL.\n\n'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 en lib/phoenix_storybook/live/story/component_iframe_live.ex lee un tema PubSub directamente de params[\"topic\"] y transmite {:component_iframe_pid, self()} en \u00e9l sin ninguna comprobaci\u00f3n de que el tema pertenezca a la sesi\u00f3n solicitante. El PhoenixStorybook.PubSub compartido se utiliza para coordinar los LiveViews del playground con sus iframes: un playground se suscribe a un tema espec\u00edfico de la sesi\u00f3n y utiliza el pid del iframe recibido para dirigir mensajes de control posteriores (estado de variaci\u00f3n, cambios de tema, cargas \u00fatiles de asignaci\u00f3n extra) a trav\u00e9s de send/2. Debido a que el iframe conf\u00eda en el par\u00e1metro de consulta, un atacante que carga /storybook/iframe/<story>?topic=<victim_topic> hace que el pid de su proceso de iframe sea anunciado en el tema de la v\u00edctima. El playground de la v\u00edctima entonces dirige sus mensajes privados al proceso de iframe del atacante.\n\nEste problema afecta a phoenix_storybook desde 0.4.0 antes de 1.1.0."}], "id": "CVE-2026-47068", "lastModified": "2026-07-23T12:10:00.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47068", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-21T13:59:23.206364Z", "version": "2.0.3"}}]}, "published": "2026-05-20T14:17:01.557", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-47068.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47068"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.4.0,1.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "phoenix_storybook", "source": "cna", "vendor": "phenixdigital"}, "product": "phoenix_storybook", "vendor": "phenixdigital"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8c2c97b0f505780fee4069988bf86736f51d35d7,6ee03f1c738d4436dde1b066cf65c80663d489f5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "phoenix_storybook", "source": "cna", "vendor": "phenixdigital"}, "product": "phoenix_storybook", "vendor": "phenixdigital"}], "created": "2026-05-20T16:00:06.779765+00:00", "updated": "2026-05-21T08:19:14.602822+00:00", "vendors": ["phenixdigital", "phenixdigital$PRODUCT$phoenix_storybook"]}