AIKIDO-2026-424812
phoenix_live_view is vulnerable to Open Redirect
21
Low Risk
This Affects:
phoenix_live_viewTL;DR
In phoenix_live_view, open redirect in Phoenix.LiveView.validate_local_url!/2 through ASCII tab, LF and CR. redirect/2 validates :to through the private validate_local_url!/2 in lib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. It rejects a leading // and any backslash, but not ASCII tab, LF or CR.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
phoenix_live_view is vulnerable to Open Redirect in versions 0.5.0 - 1.0.18, 1.1.0 - 1.1.32 and 1.2.0 - 1.2.8.
How to fix this
Upgrade the phoenix_live_view library to the patch version.
Links
Fix Commits
github.com/phoenixframework/phoenix_live_view/commit/0b8c733133466912f81adecaea72b6712370242egithub.com/phoenixframework/phoenix_live_view/commit/1c164f83df0bb922dfff9c60d125da5b0cfd6619github.com/phoenixframework/phoenix_live_view/commit/2068b304d71907064b159b6bc60c5ad85a876ecf
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.