CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
Attackers can execute JavaScript in victim sessions by bypassing URL scheme validation in Phoenix LiveView links, affecting applications rendering user-supplied URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-58228?
CVE-2026-58228 is a medium-severity cross-site scripting vulnerability in phoenixframework phoenix_live_view, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session.
The Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input's first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path.
Standard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as " javascript:alert(1)" is passed unchanged into <.link href={...}> and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim's session.
Applications that render user-supplied URLs (for example profile links, redirect targets, or external references) via <.link href={...}> are affected.
This issue affects phoenix_live_view: from 1.2.2 before 1.2.7.
Weakness: CWE-79
Which versions are affected by CVE-2026-58228?
1 open source package ship an affected version, including phoenix_live_view.
| Package | Affected | Fixed in |
|---|---|---|
phoenix_live_view Hex | From 1.2.2 | 1.2.7 |
How do I fix CVE-2026-58228?
Upgrade phoenix_live_view to 1.2.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-58228 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58228 exists.
Sources
Also known as EEF-CVE-2026-58228, GHSA-5cgh-g58j-m9cq.