dev-newsPhoenix LiveView logogithub.com/phoenixframework/phoenix_live_view

Latest stable Phoenix LiveView: 1.2.13, released (release notes). 83 stable releases since 2 Jan 2024.

Phoenix

LiveView

<.link href={...}>July 2026 · fixed in 1.2.7
Server
First byte is not a letter, so the scheme check treats it as a relative path.
Browser
The URL parser strips the leading space and runs javascript:.
GHSA-5cgh-g58j-m9cq
redirect(socket, to: ...)August 2026 · fixed in 1.0.19, 1.1.33, 1.2.9
Server
Starts with / and not //, so the guard accepts it as a local path.
Browser
The parser drops the tab and reads //evil.example, another origin.
GHSA-36m4-rm57-3prf
2024202520260.20151.0201.1341.21410 Aug: one fix, three lines
Each minor line from its first to its latest stable release on Hex, one tick per release; dotted lead-ins are release candidates. Numbers are stable releases per line.

Phoenix LiveView 1.2.13 went out on 20 October 2026 with eleven bug fixes, most of them in file uploads and form recovery. It is the 14th 1.2 release since 1.2.0 on 10 June. The older lines are still maintained: on 10 August, 1.2.9, 1.1.33 and 1.0.19 went out within four minutes of each other, the first 1.0 release in almost a year.

Both of this year's advisories come down to the same mistake: a URL check that ignores bytes the browser throws away. In July, 1.2.7 fixed a regression from 1.2.2, where a leading control or space byte let a javascript: URL past the check on <.link href>. In August, the guard behind redirect/2, push_navigate/2 and push_patch/2 turned out to miss tab, line feed and carriage return, in every version since 0.5.0.

As of 24 October 2026. LiveView security advisories.

Latest releases

  1. 1.2.13Eleven fixes, mostly uploads and form recovery; socket options forwarded to Phoenix.Socket.
  2. 1.2.12A hook’s disconnected callback no longer runs twice; JS push options left unmutated.
  3. 1.2.11Stale diffs discarded when a view rejoins early; LiveComponent async tasks cancelled on removal.
  4. 1.2.10Upload fixes, including max_entries with auto uploads.
  5. 1.0.19Security backport of the open-redirect fix to the 1.0 line.