The vulnerability in phoenix_live_view stems from the Phoenix.LiveView.Utils.valid_destination!/2 and valid_live_navigation_destination!/2 functions relying on an internal uri_scheme/1 helper that only detects a URL scheme if the first byte is an ASCII letter. Inputs starting with ASCII control characters or spaces do not trigger scheme detection and are treated as safe relative paths. However, browsers strip these leading characters before parsing URLs, allowing inputs like " javascript:alert(1)" to be interpreted as JavaScript URLs. When such URLs are rendered in <.link href={...}>, they can execute arbitrary JavaScript in the victim's browser session. This affects phoenix_live_view versions from 1.2.2 up to but not including 1.2.7.

An attacker can bypass URL scheme validation to inject JavaScript URLs that execute in the context of a victim's browser session. This cross-site scripting vulnerability can lead to script execution, potentially enabling session hijacking, data theft, or other malicious actions within the affected application. The impact is limited to scenarios where user-supplied URLs are rendered via <.link href={...}> without additional sanitization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should avoid rendering user-supplied URLs directly in <.link href={...}> or implement additional sanitization to strip leading control characters and spaces from URLs before rendering. Monitoring vendor communications for an official patch or update is recommended.