https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:03:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336220 EUVD-2026-336220 https://cve.radiocsirt.org/vuln/euvd-2026-336220 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58228 <p>Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim&#39;s browser session.</p> <p>The Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input&#39;s first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path.</p> <p>Standard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as &#34; javascript:alert(1)&#34; is passed unchanged into &lt;.link href={...}&gt; and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim&#39;s session.</p> <p>Applications that render user-supplied URLs (for example profile links, redirect targets, or external references) via &lt;.link href={...}&gt; are affected.</p> <p>This issue affects phoenix_live_view: from 1.2.2 before 1.2.7.</p> <p>Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim&#39;s browser session.</p> <p>The Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input&#39;s first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path.</p> <p>Standard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as &#34; javascript:alert(1)&#34; is passed unchanged into &lt;.link href={...}&gt; and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim&#39;s session.</p> <p>Applications that render user-supplied URLs (for example profile links, redirect targets, or external references) via &lt;.link href={...}&gt; are affected.</p> <p>This issue affects phoenix_live_view: from 1.2.2 before 1.2.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58228