Skip to content
OpenAdvisories

Package · Packagist

livewire/livewire

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 6.5
    GHSA-mhf7-xp6r-6qrc

    Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

    ### Impact Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for: 1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while t…

    livewire/livewire Packagist
  • Medium 5.1
    CVE-2026-81887

    Livewire DOM-based cross-site scripting during client-side state handling

    Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, a…

    livewire livewire livewire/livewire Packagist
  • Critical 9.2
    CVE-2025-54068 Exploited Public exploit Scanner template EPSS 96%

    Livewire vulnerable to remote command execution during property update hydration

    Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates …

    livewire livewire livewire/livewire Packagist
    KEV Mar 20, 2026
  • High 7.7
    CVE-2024-47823 Public exploit

    Livewire Remote Code Execution (RCE) on File Uploads

    Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual fi…

    livewire livewire livewire/livewire Packagist
  • Medium —
    GHSA-qwvp-268g-jjm8

    Data Leakage Vulnerability in livewire/livewire

    livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The `$this->validate()` method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. Thi…

    livewire/livewire Packagist
  • Medium 6.1
    CVE-2024-21504

    Cross-site Scripting in livewire/livewire

    Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious lin…

    livewire/livewire Packagist