alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-58228 Phoenix LiveView - Cross-Site Scripting via control-character javascript scheme bypass"; flow:established,to_server; http.uri; content:"javascript"; nocase; fast_pattern; pcre:"/(%0[0-9a-f]|%1[0-9a-f]|%20)javascript(%3a|:)/i"; classtype:web-application-attack; reference:cve,CVE-2026-58228; reference:url,https://www.exploit.observer/?keyword=CVE-2026-58228&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=phoenix-live-view&match=exact; metadata:signature_type network_only; sid:1079206; rev:1;)