Eurico Nicacio

**Name of the Vulnerable Software and Affected Versions** phoenix live view versions 0.5.0 through 1.0.18 phoenix live view versions 1.1.0-rc.0 through 1.1.32 phoenix live view versions 1.2.0-rc.0 through 1.2.8 **Description** An Open Redirect issue exists where an attacker can redirect a victim's browser to an arbitrary origin. This occurs because the `redirect/2` function uses `validate local url!/2` to ensure the target is a local path, but it fails to reject ASCII tab, LF, or CR characters. Since browsers strip these characters before parsing the URL, a value like `/<TAB>/example.com` bypasses validation and is interpreted as a scheme-relative URL. The `push patch/2` function is also affected in versions prior to 0.7.0. The issue is triggered when the application passes an externally influenced value as the `:to` parameter, such as a `return to` parameter during sign-in or a navigation target from a `handle event/3` payload. **Recommendations** Update phoenix live view to version 1.0.19 or later. Update phoenix live view to version 1.1.33 or later. Update phoenix live view to version 1.2.9 or later. Reject any untrusted value containing ASCII tab, LF, or CR before passing it as the `:to` parameter to `redirect/2` or `push patch/2` (for versions prior to 0.7.0). Map client-supplied navigation targets to a fixed set of known-good paths instead of forwarding the value directly.