Phoenix.LiveView uses validate_local_url!/2 to ensure redirection targets stay within the application, but it does not reject ASCII tab, line feed, or carriage return characters. When a victim’s browser receives a URL that contains one of these invisible characters in the :to argument, the browser strips the characters before parsing, turning a path such as /<TAB>/example.com into the scheme‑relative URL //example.com. This allows an attacker to redirect users to an arbitrary external site, enabling phishing or malicious malware delivery. The weakness is a classic open redirect flaw (CWE‑601).

This vulnerability is present in Phoenix LiveView releases from 0.5.0 up to (but not including) 1.0.19, from the 1.1.0‑rc.0 series up to 1.1.33, and from the 1.2.0‑rc.0 series up to 1.2.9. Affected vendors include the Phoenix Framework; any application using these versions of the phoenix_live_view library is potentially impacted.

The CVSS score of 2.1 indicates a low severity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it has not yet been widely exploited. Nevertheless, the flaw can be leveraged to send unsuspecting users to attacker‑controlled domains, so a moderate reputation or phishing risk exists. An attacker would need to craft a redirect or push_patch call with a :to value that includes an invisible tab, LF or CR; the victim must then click or otherwise trigger the redirect within the application.