Type Vulnerability
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. Known-exploited catalogue reports exploitation in the wild.
Laravel
Laravel Livewire Code Injection Vulnerability
CVE-2025-54068
What this means
This is rated critical severity (9.2 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Laravel Livewire is in your estate, and treat that as the priority.
Full vendor description
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
Scoring and exploitation
9.2/ 10
CVSS 4.0 base scoreCritical
Exploitable over the network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityHighAC:H
Attack requirementsNoneAT:N
Privileges requiredNonePR:N
User interactionNoneUI:N
Impact
Longer bar: more harm
ConfidentialityHighVC:H
IntegrityHighVI:H
AvailabilityHighVA:H
- Elevated attack likelihood (~96.3% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Laravel Livewire
Weaknesses
CWE-94
Affected products ()
- Laravel Livewire
Show the raw CPE strings (1)
- cpe:2.3:a:laravel:livewire:*:*:*:*:*:*:*:*
References
5 links from the CVE record, grouped by site; the vendor's advisory comes first.
github.com3 linksVendor advisory
- ef04be759da41b14d2d129e670533180a44987dc (opens in a new tab)Patch
- v3.6.4 (opens in a new tab)Release Notes
- GHSA-29cq-5w36-x7w3 (opens in a new tab)Vendor Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource
threathunter.ai1 link
- iranian-threat-actor-tools-techniques-iocs-ioas (opens in a new tab)Third Party Advisory