CVE-2026-58228: phoenix_live_view 1.2.2 to before 1.2.7

Affected technology

phoenix_live_view · 1.2.2 to before 1.2.7
phoenixframework

phoenix_live_view · 4b63216ae68886db99cf7772af23372d76c40e7e to before 86165533e311469a1b62093fd182d9d874de8106
phoenixframework

Component: 'Elixir.Phoenix.LiveView.Utils'
Function: 'Elixir.Phoenix.LiveView.Utils':valid_destination!/2, 'Elixir.Phoenix.LiveView.Utils':valid_live_navigation_destination!/2
File: lib/phoenix_live_view/utils.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

An attacker can bypass URL scheme validation and execute JavaScript in a victim's browser session. Source advisory’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and integrity impact as low; availability impact as none.