CVE-2026-64941: phoenix_live_view 0.5.0 to before 1.0.19, 1.1.0-rc.0 to before 1.1.33, 1.2.0-rc.0 to before 1.2.9

Affected technology

phoenix_live_view · 0.5.0 to before 1.0.19, 1.1.0-rc.0 to before 1.1.33, 1.2.0-rc.0 to before 1.2.9
phoenixframework

phoenix_live_view · b20dba3f65a380b2e4868dae03397f13d2daa070 to before *; status changes: 0b8c733133466912f81adecaea72b6712370242e — unaffected, 1c164f83df0bb922dfff9c60d125da5b0cfd6619 — unaffected, 2068b304d71907064b159b6bc60c5ad85a876ecf — unaffected
phoenixframework

Component: 'Elixir.Phoenix.LiveView'
Function: 'Elixir.Phoenix.LiveView':redirect/2, 'Elixir.Phoenix.LiveView':push_patch/2
File: lib/phoenix_live_view.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

An attacker can send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validate_local_url!/2 in lib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. Source advisory’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality, integrity and availability impact as none.