CVE-2024-55661

Laravel Pulse prior to version 1.3.1 contains a code injection flaw (CWE-94) in the public remember() method of the Laravel\Pulse\Livewire\Concerns\RemembersQueries trait, which is used by Pulse card components. Because Livewire exposes public component methods to the browser, an authenticated user with access to the Pulse dashboard can invoke remember() with an arbitrary callable — a function name or static Class::method string with no parameters or no strict parameter types — causing the application to execute attacker-chosen code. Successful exploitation yields remote code execution in the context of the Laravel application (high impact on confidentiality, integrity, and availability per the CVSS 4.0 score of 8.7). All deployments of Laravel Pulse before 1.3.1 are affected, but only where an authenticated user can reach the dashboard's Livewire endpoints. No public proof-of-concept or confirmed in-the-wild exploitation is known, although EPSS assigns an elevated 29.7% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade to Laravel Pulse 1.3.1 or later immediately. Restrict access to the Pulse dashboard to trusted, authenticated users and audit which accounts and roles can reach Pulse routes, since exploitation requires dashboard access. Given the elevated EPSS score, prioritize patching and watch for emerging proof-of-concept code.