Livewire CVE-2026-81887

Exploitation requires that a user actively opens a specially crafted URL - the attacker cannot trigger the vulnerability server-side or without user interaction. The affected application must be running Livewire 3.0.0-beta.1 through 3.8.2 or 4.0.0 through 4.3.3 with the Livewire JavaScript bundle loaded in the browser. No authentication is required of the attacker (PR:N per CVSS 4.0 vector). The attack does not require any non-default configuration - any standard Livewire deployment with URL history/query-string support enabled (which is a core Livewire feature) is susceptible. Limiting factors include: victim must click or otherwise open the crafted URL (social engineering dependency); impact is bounded to the victim's own session and same-origin context, not the server or other users; the attacker gains no server-side privileges or access beyond what the victim user possesses.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the primary risk limiter: mandatory active user interaction (UI:A). An attacker cannot exploit this without tricking a victim into opening a crafted URL. The subsequent-system impact metrics (SC:L/SI:L) reflect that the direct server is unaffected - harm is limited to the victim's browser session within the application's same-origin context, enabling cookie theft, credential harvesting, or actions performed on behalf of the victim. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. Despite the moderate composite score, the real-world risk is non-trivial: the affected version range spans from the first Livewire 3 beta through current production versions across both the 3.x and 4.x branches, potentially covering a large fraction of deployed Livewire applications. The fix-confirmation via tagged releases and PR diff is strong, but the absence of EPSS and KEV data means exploitation likelihood cannot be independently quantified from available signals.

An attacker crafts a URL such as https://target.example.com/page?__proto__[scripts]=<malicious_js> and distributes it via phishing email or social media. When an authenticated or unauthenticated victim opens the link in their browser, Livewire's fromQueryString() processes the __proto__ segment without sanitization, polluting Object.prototype.scripts with the attacker's payload; the supportScriptsAndAssets.js handler then reads effects.scripts without a hasOwnProperty guard and executes the attacker-controlled JavaScript within the application's origin, potentially exfiltrating session cookies or performing actions as the victim. No public POC has been identified at time of analysis, but the attack mechanism is straightforward for anyone familiar with prototype pollution techniques.