CVE-2026-58228

Full vulnerability record from the local CVENow database.

Description

Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input's first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path. Standard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as " javascript:alert(1)" is passed unchanged into <.link href={...}> and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim's session. Applications that render user-supplied URLs (for example profile links, redirect targets, or external references) via <.link href={...}> are affected. This issue affects phoenix_live_view: from 1.2.2 before 1.2.7.

Severity

MEDIUM

CVSS score

5.1 (v4.0)

Vulnerability status

Deferred

Source identifier

6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Published

2026-07-13 19:17:30.317000

Last modified

2026-10-24 22:10:00.210000

View original CVE JSON

{
  "id": "CVE-2026-58228",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-07-13T19:17:30.317",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session.\n\nThe Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input's first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path.\n\nStandard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as \" javascript:alert(1)\" is passed unchanged into <.link href={...}> and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim's session.\n\nApplications that render user-supplied URLs (for example profile links, redirect targets, or external references) via <.link href={...}> are affected.\n\nThis issue affects phoenix_live_view: from 1.2.2 before 1.2.7."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cross-site scripting en phoenixframework phoenix_live_view permite a un atacante eludir la validación del esquema de URL y ejecutar JavaScript en la sesión del navegador de una víctima.\n\nLas funciones Phoenix.LiveView.Utils.valid_destination!/2 y Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 en lib/phoenix_live_view/utils.ex dependen de una función auxiliar interna uri_scheme/1 que solo detecta un esquema cuando el primer byte de la entrada es una letra ASCII. Las entradas que comienzan con un carácter de control ASCII o un espacio pasan a una cláusula que devuelve nil, lo que hace que la URL sea tratada como una ruta relativa segura.\n\nLos navegadores estándar implementan el analizador de URL WHATWG, que elimina los caracteres de control C0 y los espacios iniciales antes de analizar. Como resultado, una entrada como ’ javascript_disabled: alert(1)’ se pasa sin cambios a <.link href={...}> y, al hacer clic, es analizada por el navegador como una URL javascript_disabled: que ejecuta un script controlado por el atacante en la sesión de la víctima.\n\nLas aplicaciones que renderizan URL proporcionadas por el usuario (por ejemplo, enlaces de perfil, objetivos de redirección o referencias externas) a través de <.link href={...}> se ven afectadas.\n\nEste problema afecta a phoenix_live_view: desde la versión 1.2.2 anterior a la 1.2.7."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "phoenixframework",
          "product": "phoenix_live_view",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "phoenix_live_view",
          "cpes": [
            "cpe:2.3:a:phoenixframework:phoenix_live_view:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Phoenix.LiveView.Utils'"
          ],
          "programFiles": [
            "lib/phoenix_live_view/utils.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Phoenix.LiveView.Utils':valid_destination!/2"
            },
            {
              "name": "'Elixir.Phoenix.LiveView.Utils':valid_live_navigation_destination!/2"
            }
          ],
          "repo": "https://github.com/phoenixframework/phoenix_live_view",
          "packageURL": "pkg:hex/phoenix_live_view",
          "versions": [
            {
              "version": "1.2.2",
              "lessThan": "1.2.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "phoenixframework",
          "product": "phoenix_live_view",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "phoenixframework/phoenix_live_view",
          "cpes": [
            "cpe:2.3:a:phoenixframework:phoenix_live_view:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Phoenix.LiveView.Utils'"
          ],
          "programFiles": [
            "lib/phoenix_live_view/utils.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Phoenix.LiveView.Utils':valid_destination!/2"
            },
            {
              "name": "'Elixir.Phoenix.LiveView.Utils':valid_live_navigation_destination!/2"
            }
          ],
          "repo": "https://github.com/phoenixframework/phoenix_live_view",
          "packageURL": "pkg:github/phoenixframework/phoenix_live_view",
          "versions": [
            {
              "version": "4b63216ae68886db99cf7772af23372d76c40e7e",
              "lessThan": "86165533e311469a1b62093fd182d9d874de8106",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T18:58:11.563760Z",
          "id": "CVE-2026-58228",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-58228.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/phoenixframework/phoenix_live_view/commit/86165533e311469a1b62093fd182d9d874de8106",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/phoenixframework/phoenix_live_view/security/advisories/GHSA-5cgh-g58j-m9cq",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-58228",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/phoenixframework/phoenix_live_view/security/advisories/GHSA-5cgh-g58j-m9cq",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}