AIKIDO-2026-664086

TL;DR

The Phoenix adapter embeds the Inertia page object as JSON inside a <script data-page="app" type="application/json"> tag in the initial HTML response without escaping <. A prop containing </script> ends the script element early in client rendered output, while <!--<script> disrupts HTML parsing in SSR output, so user controlled props such as names or comments can inject markup and scripts during the initial page load. Subsequent Inertia visits are not affected because their JSON responses are not parsed as HTML. The fix encodes every < in the page data as \u003c in both code paths.