chore(deps): update dependency phoenix_live_view to v1.2.9 [security] - autoclosed #579
No reviewers
Labels
No labels
bug
duplicate
enhancement
help wanted
high priority
invalid
L
low priority
M
medium priority
needs refinement
optional
question
S
security
technical improvement
UX Improvement
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
local-it/mitgliederverwaltung!579
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/hex-phoenix_live_view-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1.2.5→1.2.9Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
CVE-2026-58228 / EEF-CVE-2026-58228 / GHSA-5cgh-g58j-m9cq
More information
Details
Summary
Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session.
The Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input's first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path.
Standard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as " javascript:alert(1)" is passed unchanged into <.link href={...}> and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim's session.
Applications that render user-supplied URLs (for example profile links, redirect targets, or external references) via <.link href={...}> are affected.
This issue affects phoenix_live_view: from 1.2.2 before 1.2.7.
Workarounds
Strip leading ASCII control and space bytes (code points 0x00 through 0x20) from any untrusted URL before passing it to <.link href={...}>, or reject such inputs outright. This aligns application-level validation with the WHATWG URL parser used by browsers and prevents the scheme-detection bypass.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV.
Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
CVE-2026-64941 / EEF-CVE-2026-64941 / GHSA-36m4-rm57-3prf
More information
Details
Summary
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim's browser to an origin of the attacker's choosing via a
:tovalue containing ASCII tab, LF or CR.redirect/2validates:tothrough the privatevalidate_local_url!/2inlib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. It rejects a leading//and any backslash, but not ASCII tab, LF or CR. Browsers strip those three characters before parsing a URL, so a value such as/<TAB>/example.compasses validation as a path and is then resolved as the scheme-relative URL//example.com. The live navigation functions share the guard but are not affected, because the client expands their target against the current origin.push_patch/2is also affected before 0.7.0, which is when that expansion was added.This issue affects phoenix_live_view: from 0.5.0 before 1.0.19, from 1.1.0-rc.0 before 1.1.33, and from 1.2.0-rc.0 before 1.2.9.
Workarounds
Reject any untrusted value containing ASCII tab, LF or CR before passing it as
:totoredirect/2, or topush_patch/2before 0.7.0. Alternatively, map client-supplied navigation targets to a fixed set of known-good paths rather than forwarding the value.Configurations
The application must pass an externally influenced value as
:totoredirect/2, or topush_patch/2before 0.7.0, for example areturn_toparameter carried through sign-in or a navigation target taken from ahandle_event/3payload.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by OSV.
Release Notes
phoenixframework/phoenix_live_view (phoenix_live_view)
v1.2.9Compare Source
Security fixes
redirect/2via ASCII tab, LF and CRBug fixes
Enhancements
v1.2.8Compare Source
Enhancements
You can now listen for the
phx:before-navigateevent and callevent.preventDefault()to cancel the navigation synchronously.This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a
beforeunloadlistener.:localto avoid node names being included in the tokenBug fixes
detail.lock()promise inphx:pushevent never resolving (#4351)v1.2.7Compare Source
Security fixes
Phoenix.LiveView.Utilsv1.2.6Compare Source
Bug fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
6e2334a747a28ee64550a28ee64550d47b5f60bad47b5f60ba3bd92f16c9chore(deps): update dependency phoenix_live_view to v1.2.9 [security]to chore(deps): update dependency phoenix_live_view to v1.2.9 [security] - autoclosedPull request closed