Skip to content
OpenAdvisories

Vendor

phoenixframework

6 known vulnerabilities.

Products

phoenix 3 phoenix_live_view 2 phoenix_html 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-117645

    Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_…

    phoenixframework phoenix_html phoenix_html Hex
  • Medium 5.1
    CVE-2026-58228

    Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

    Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_…

    phoenixframework phoenix_live_view phoenix_live_view Hex
  • Medium 6.3
    CVE-2026-56812

    Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

    Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence …

    phoenixframework phoenix phoenix phoenix npm Hex