The vulnerability in phoenix_live_view stems from improper neutralization of input during web page generation, specifically in the Phoenix.LiveView.Utils.valid_destination!/2 and valid_live_navigation_destination!/2 functions. These rely on an internal uri_scheme/1 helper that only detects a URL scheme if the first byte is an ASCII letter. Inputs beginning with ASCII control characters or spaces bypass this check, returning nil and causing the URL to be treated as a safe relative path. Since browsers strip leading control and space characters before parsing URLs, an input like " javascript:alert(1)" is interpreted as a javascript: URL, enabling execution of attacker-controlled scripts in the victim's session. This affects phoenix_live_view versions from 1.2.2 up to but not including 1.2.7.

An attacker can bypass URL scheme validation to inject and execute arbitrary JavaScript in the context of a victim's browser session. This can lead to cross-site scripting attacks, potentially allowing session hijacking, defacement, or other malicious actions within the affected application. The impact is limited to applications that render user-supplied URLs via <.link href={...}> and do not implement additional validation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid rendering user-supplied URLs directly in <.link href={...}> without strict validation or sanitization that accounts for leading control and space characters. Consider implementing custom URL validation that normalizes inputs before scheme checks to prevent bypass.