EUVD-2026-68765
GHSA-g3hc-697w-wm82
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered URL, no attacker privileges, requires victim interaction (UI:R), scope changes to browser origin enabling limited credential theft and DOM manipulation.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers then access effects.html, effects.js, effects.xjs, and effects.scripts without Object.prototype.hasOwnProperty.call(), allowing inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Exploitation requires user interaction and does not bypass server-side authorization or grant privileges beyond the affected user. This issue is fixed in versions 3.8.3 and 4.3.4.
AnalysisAI
Prototype pollution in Livewire's client-side query-string parser enables reflected cross-site scripting against applications running versions 3.0.0-beta.1 through 3.8.2 or 4.0.0 through 4.3.3. The dot-notated URL parser in js/plugins/history/index.js accepts __proto__, constructor, and prototype as path segments, injecting attacker-controlled values into Object.prototype; multiple effect handlers then read effects.html, effects.js, effects.xjs, and effects.scripts without hasOwnProperty guards, treating inherited values as trusted server-delivered directives and executing arbitrary JavaScript in the application's origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user actively opens a specially crafted URL - the attacker cannot trigger the vulnerability server-side or without user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) accurately reflects the primary risk limiter: mandatory active user interaction (UI:A). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Livewire 3.8.3 (https://github.com/livewire/livewire/releases/tag/v3.8.3) or Livewire 4.3.4 (https://github.com/livewire/livewire/releases/tag/v4.3.4), confirmed via tagged GitHub releases and the fix commit at https://github.com/livewire/livewire/commit/11ebe646f7e81dde2d714815da8b3019d058561e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th
Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. Rated high sev
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when
Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today