Cross‑Site Scripting (XSS) occurs when an attacker submits a URL that begins with a space or control character. The Phoenix.LiveView.Utils.valid_destination!/2 functions only check the first byte to determine a scheme, so the string is treated as a relative path and passed unchanged to <.link href={...}>. Browsers parse the link using the WHATWG URL parser, which strips leading whitespace, turning the string into a javascript: URL and executing attacker‑supplied code in the victim’s browser. This flaw is categorized as CWE‑79 and allows arbitrary client‑side code execution when the user clicks the link.

The vulnerability affects Phoenix LiveView versions 1.2.2 through 1.2.6. Applications rendering user‑supplied URLs via <.link href={...}> are directly impacted.

The CVSS score of 5.1 classifies the vulnerability as medium severity. The EPSS score of less than 1 % indicates a low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting no known active exploitation. The workaround consists of stripping leading ASCII control and space characters before rendering the URL, or rejecting such values, which aligns application‑level validation with the browser’s WHATWG URL parser.