The vulnerability in phoenix_live_view involves improper validation of the :to parameter in the redirect/2 function. Although the function attempts to restrict redirects to local paths by rejecting leading // and backslashes, it does not reject ASCII tab, line feed, or carriage return characters. Browsers remove these characters before parsing URLs, allowing a crafted :to value such as /<TAB>/example.com to bypass validation and be interpreted as a scheme-relative URL (//example.com), effectively redirecting users to an attacker-controlled site. The live navigation functions are not affected due to client-side URL expansion, but push_patch/2 is affected before version 0.7.0. Affected versions include phoenix_live_view from 0.5.0 before 1.0.19, from 1.1.0-rc.0 before 1.1.33, and from 1.2.0-rc.0 before 1.2.9.

An attacker can craft URLs that cause a victim's browser to be redirected to an arbitrary external site controlled by the attacker. This can facilitate phishing or other social engineering attacks by leveraging the trust in the vulnerable application. The vulnerability does not allow code execution or data leakage directly but can be used to redirect users to malicious sites. The CVSS score is low (2.1), reflecting the limited scope and requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using redirect/2 with untrusted input or sanitize the :to parameter to reject ASCII tab, LF, and CR characters explicitly. Monitor vendor channels for updates and apply official patches once released.