Skip to content
Phoenixframework Phoenix vulnerabilities
-
phoenixframework phoenix html
Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
CVE-2026-117645
Fix available
5.3 Medium
-
phoenixframework phoenix live view
Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
CVE-2026-64941
Fix available
2.1 Low
-
phoenixframework phoenix live view
Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
CVE-2026-58228
Fix available
5.1 Medium
-
phoenixframework phoenix
Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff
CVE-2026-56812
Fix available
6.3 Medium
-
phoenixframework phoenix
Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service
CVE-2026-56811
Fix available
8.7 High
-
phoenixframework phoenix
Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix
CVE-2026-32689
Fix available
8.7 High
-
phoenixframework phoenix
Phoenix before 1.6.14 mishandles check_origin wildcarding
CVE-2022-42975
Fix available
7.5 High
-
phoenixframework phoenix html
phoenix_html allows Cross-site Scripting in HEEx class attributes
CVE-2021-46871
Fix available
6.1 Medium
-
phoenixframework phoenix
Phoenix Arbitrary URL Redirect
CVE-2017-1000163
Fix available
6.1 Medium