CVE-2026-58228: Phoenix.LiveView.Utils Scheme Validation Bypass Leading to XSS
Summary
CVE-2026-58228: Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via. Affects phoenix_live_view across 2 version ranges.
>= 1.2.2, < 1.2.7
>= 4b63216ae68886db99cf7772af23372d76c40e7e, < 86165533e311469a1b62093fd182d9d874de8106
Fixed in 1.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Phoenix LiveView is a library for the Phoenix framework that enables rich, real-time user experiences with server-rendered HTML. It allows developers to create interactive applications without requiring client-side JavaScript frameworks. However, it is susceptible to vulnerabilities, including the scheme validation bypass that can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the improper validation of URL schemes in the Phoenix.LiveView.Utils.valid_destination!/2 and valid_live_navigation_destination!/2 functions. These functions rely on an internal uri_scheme/1 helper that fails to detect schemes when the input begins with ASCII control characters or spaces. This flaw allows attackers to craft URLs that are treated as safe, enabling them to execute JavaScript in a victim's browser session when the link is clicked. As a result, applications rendering user-supplied URLs via <.link href={...}> are at risk of XSS attacks.
How To Fix
Latest published version: 1.2.13 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, strip leading ASCII control and space bytes (code points 0x00 through 0x20) from any untrusted URL before passing it to <.link href={...}>. This can be implemented in your code as follows:
def sanitize_url(url) do
String.trim_leading(url, String.to_charlist("\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F "))
end
This aligns your validation with the WHATWG URL parser used by browsers.
Conclusion
The CVE-2026-58228 vulnerability in the Phoenix LiveView library poses a significant risk of XSS attacks due to improper URL scheme validation. It is crucial to update to the patched version or implement workarounds to secure your application against potential exploitation.
See every vulnerability recorded for phoenix_live_view →
FAQ
CVE-2026-58228 is a cross-site scripting vulnerability in the Phoenix LiveView library that allows attackers to bypass URL scheme validation.
If your application renders user-supplied URLs via <.link href={...}>, it may allow attackers to execute malicious JavaScript in users' browsers.
The vulnerability affects phoenix_live_view versions from 1.2.2 up to, but not including, 1.2.7.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 5.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for phoenix_live_view.
