All vulnerabilities
CVE-2025-54068GHSA-29cq-5w36-x7w3

Laravel Livewire Code Injection Vulnerability

Laravel LivewirePackagistFrameworks
Open in ThreatlineRecord JSON
CVSS
9.2Critical
ExploitationExploited in the wildAdded to KEV 20 Mar 2026CISA KEV
Exploit odds (EPSS)96.3%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.6.4Fixed versionOSV
Federal deadline3 Apr 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 3.6.4livewire/livewire, PackagistOSVcomposer require "livewire/livewire:^3.6.4"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 17 Jul 2025, 18:16 UTCPublishedCVE List
  2. 20 Mar 2026Added to CISA KEVCISA KEV

Public exploit code and templates 1

  • Scanner templateLaravel Livewire v3 - Remote Command ExecutionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.

Text from CVE List

Affected versions 52

  • livewireaffected: >= 3.0.0-beta.1, < 3.6.4CVE List
  • livewire/livewire, Packagistfrom 3.0.0-beta.1, fixed in 3.6.4OSV
  • livewire/livewire, Packagistv3.0.0OSV
  • livewire/livewire, Packagistv3.0.0-beta.1OSV
  • livewire/livewire, Packagistv3.0.0-beta.10OSV
  • livewire/livewire, Packagistv3.0.0-beta.11OSV
  • livewire/livewire, Packagistv3.0.0-beta.2OSV
  • livewire/livewire, Packagistv3.0.0-beta.3OSV
  • livewire/livewire, Packagistv3.0.0-beta.4OSV
  • livewire/livewire, Packagistv3.0.0-beta.5OSV
  • livewire/livewire, Packagistv3.0.0-beta.6OSV
  • livewire/livewire, Packagistv3.0.0-beta.7OSV
  • livewire/livewire, Packagistv3.0.0-beta.8OSV
  • livewire/livewire, Packagistv3.0.0-beta.9OSV
  • livewire/livewire, Packagistv3.0.1OSV
  • livewire/livewire, Packagistv3.0.10OSV
  • livewire/livewire, Packagistv3.0.2OSV
  • livewire/livewire, Packagistv3.0.3OSV
  • livewire/livewire, Packagistv3.0.4OSV
  • livewire/livewire, Packagistv3.0.5OSV
  • livewire/livewire, Packagistv3.0.6OSV
  • livewire/livewire, Packagistv3.0.7OSV
  • livewire/livewire, Packagistv3.0.8OSV
  • livewire/livewire, Packagistv3.0.9OSV
  • livewire/livewire, Packagistv3.1.0OSV
  • livewire/livewire, Packagistv3.2.0OSV
  • livewire/livewire, Packagistv3.2.1OSV
  • livewire/livewire, Packagistv3.2.2OSV
  • livewire/livewire, Packagistv3.2.3OSV
  • livewire/livewire, Packagistv3.2.4OSV
  • livewire/livewire, Packagistv3.2.5OSV
  • livewire/livewire, Packagistv3.2.6OSV
  • livewire/livewire, Packagistv3.3.0OSV
  • livewire/livewire, Packagistv3.3.1OSV
  • livewire/livewire, Packagistv3.3.2OSV
  • livewire/livewire, Packagistv3.3.3OSV
  • livewire/livewire, Packagistv3.3.4OSV
  • livewire/livewire, Packagistv3.3.5OSV
  • livewire/livewire, Packagistv3.4.0OSV
  • livewire/livewire, Packagistv3.4.1OSV
  • livewire/livewire, Packagistv3.4.10OSV
  • livewire/livewire, Packagistv3.4.11OSV
  • livewire/livewire, Packagistv3.4.12OSV
  • livewire/livewire, Packagistv3.4.2OSV
  • livewire/livewire, Packagistv3.4.3OSV
  • livewire/livewire, Packagistv3.4.4OSV
  • livewire/livewire, Packagistv3.4.5OSV
  • livewire/livewire, Packagistv3.4.6OSV
  • livewire/livewire, Packagistv3.4.7OSV
  • livewire/livewire, Packagistv3.4.8OSV
  • livewire/livewire, Packagistv3.4.9OSV
  • livewire/livewire, Packagistv3.5.0OSV

References 6