The vulnerability arises because redirect/2 validates the :to parameter using validate_local_url!/2, which rejects leading // and backslashes but does not reject ASCII tab, line feed (LF), or carriage return (CR) characters. Browsers strip these characters before parsing URLs, allowing a crafted :to value such as /<TAB>/example.com to be interpreted as a scheme-relative URL (//example.com), redirecting users to an external site controlled by an attacker. The live navigation functions are not affected due to client-side URL expansion, but push_patch/2 is affected in versions before 0.7.0. The affected phoenix_live_view versions are 0.5.0 up to but not including 1.0.19, 1.1.0-rc.0 up to but not including 1.1.33, and 1.2.0-rc.0 up to but not including 1.2.9.

An attacker can exploit this vulnerability to redirect users to arbitrary external URLs by crafting malicious :to values containing ASCII tab, LF, or CR characters. This can facilitate phishing or other social engineering attacks by making malicious URLs appear as local paths. The impact is limited to user redirection and does not include code execution or data exposure. The CVSS score of 2.1 (low) reflects the limited severity and the requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade phoenix_live_view to versions 1.0.19 or later, 1.1.33 or later, or 1.2.9 or later once official fixes are released. Until then, carefully validate and sanitize any user-controllable :to parameters to prevent injection of ASCII tab, LF, or CR characters. Avoid relying solely on validate_local_url!/2 for URL validation.