Read the docs
TI-2025-33912 Aliases CVE-2025-54068GHSA-29cq-5w36-x7w3

Livewire vulnerable to remote command execution during property update hydration

Priority CRITICAL 99Exploited in the wildCWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

Why it matters now

Exploitation Active In CISA KEV since 2026-03-20CISA due date 2026-04-03
EPSS 0.96284 99th percentileScored 2026-11-07
Fix Fixed livewire (livewire): 3.6.4livewire/livewire (Packagist): 3.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
livewirelivewire3.0.0-beta.1 to before 3.6.43.6.4Patch availableCNA
—livewire/livewire (Packagist)3.0.0-beta.1 to before 3.6.43.6.4Patch availableGHSA-29cq-5w36-x7w3
  • livewire Vendorlivewire Affected 3.0.0-beta.1 to before 3.6.4 Fixed in 3.6.4 Patch available CNA
  • livewire/livewire (Packagist) Vendor— Affected 3.0.0-beta.1 to before 3.6.4 Fixed in 3.6.4 Patch available GHSA-29cq-5w36-x7w3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:laravel:livewire:*:*:*:*:*:*:*:*3.0.0 to before 3.6.4VulnerableLaravel
  • cpe:2.3:a:laravel:livewire:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.6.4 Vulnerable ·Laravel

Remediation

  • Fix · CNA livewire (livewire) Fixed in 3.6.4
  • Fix · GHSA-29cq-5w36-x7w3 livewire/livewire (Packagist) Fixed in 3.6.4 Advisory →

Timeline

  1. 2026-03-20 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-54068
  3. 2026-10-03 Alias added: GHSA-29cq-5w36-x7w3

References

Patch 1

Advisory 3

Other 4

  • TI-2025-20349 Volt Allows RCE Via User-Crafted Requests CVSS 4.0CRITICAL 9.3
  • TI-2026-56498 Livewire DOM-based cross-site scripting during client-side state handling CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences