Livewire
CVE-2025-54068
CRITICAL
GHSA-29cq-5w36-x7w3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8 (Critical). KEV-listed — actively exploited. EPSS 16%. Patch available (v3.6.4+). No authentication required. Laravel/Livewire powers thousands of web applications. Server-side code execution. Unique to Livewire v3. |
| Exploit ScenarioDerived | An attacker sends crafted Livewire update requests to a Laravel application, manipulating the component hydration payload to inject PHP code. The server deserializes and processes the malicious payload, executing the injected code with the web server's privileges. The attacker gains: access to the application database (user data, credentials), access to environment variables (API keys, database credentials, mail server passwords), server filesystem access, and ability to modify the application's behavior. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) that allows unauthenticated attackers to execute commands through improper hydration of component property updates. KEV-listed with EPSS 16%, this vulnerability affects one of the most popular PHP frameworks, potentially compromising thousands of Laravel applications using Livewire for reactive server-side rendering.
Earlier versions of this analysis (1)
Livewire v3's component hydration process (CWE-94) improperly handles property updates, allowing unauthenticated attackers to inject and execute arbitrary code on the server in specific component configurations.
RemediationAI
Upgrade Livewire to v3.6.4 or later immediately. If unable to upgrade, review component property definitions for potentially vulnerable patterns. Rotate all secrets in .env after patching. Audit application logs for suspicious Livewire requests.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Livewire is a full-stack framework for Laravel that enables reactive server-side rendering. Component state is serialized, sent to the client, and deserialized (hydrated) on subsequent requests. The vulnerability exists in how certain property updates are hydrated — attacker-controlled data can influence the hydration process to execute arbitrary PHP code. This affects Livewire v3 specifically (introduced in the v3 rewrite) and is exploitable without authentication on any page using vulnerable component patterns.
Know when Livewire gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
Executive ViewAI
Laravel applications using Livewire v3 up to v3.6.3 are exposed to unauthenticated remote code execution, allowing attackers to gain complete control of affected servers without valid credentials. This vulnerability is confirmed actively exploited (CISA KEV) with Iranian threat actors observed targeting deployments, creating immediate risk of data breach, service disruption, and infrastructure compromise across any organization running vulnerable Livewire versions.
Apply vendor patch (upgrade to Livewire v3.6.4 or later). If immediate patching is not feasible, implement WAF rules to block malicious property updates during component hydration, disable Livewire components at the web application firewall level, and restrict network access to affected Laravel applications to trusted IPs only pending patch deployment.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. Rated high sev
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when
Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary
Rapyd Admin 9.0.0 through 9.19.x lets an authenticated company member holding the default `customer` role hijack arbitra
Privilege escalation in Shopper 2.0.0 through 2.5.x allows an authenticated admin-panel user who holds only the access_d
Prototype pollution in Livewire's client-side query-string parser enables reflected cross-site scripting against applica
Exploit-DB