Skip to content
OpenAdvisories

Package · Packagist

livewire/livewire

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.5
    GHSA-mhf7-xp6r-6qrc

    Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

    ### Impact Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for: 1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while t…

    livewire/livewire Packagist
  • Medium 5.1
    CVE-2026-81887

    Livewire DOM-based cross-site scripting during client-side state handling

    Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, a…

    livewire livewire livewire/livewire Packagist
  • Medium —
    GHSA-qwvp-268g-jjm8

    Data Leakage Vulnerability in livewire/livewire

    livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The `$this->validate()` method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. Thi…

    livewire/livewire Packagist
  • Medium 6.1
    CVE-2024-21504

    Cross-site Scripting in livewire/livewire

    Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious lin…

    livewire/livewire Packagist