ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2025-54068

KEVlarge

Unauthenticated Code Injection RCE in Laravel Livewire v3

CISA: Laravel Livewire Code Injection Vulnerability

CVSS 4.0
9.2 critical
EPSS
96%p100
Published
()
KEV added
AI analysis

CVE-2025-54068 is an improper hydration flaw (CWE-94 code injection) in Livewire v3, a full-stack framework for Laravel, that allows unauthenticated attackers to achieve remote command execution in specific scenarios. The flaw is triggered when a Livewire component is mounted and configured in a particular way and receives certain component property updates, with no authentication or user interaction required. A successful attacker gains code execution on the server hosting the affected Laravel application. Only Livewire v3 up to and including v3.6.3 is affected; earlier major versions are not impacted, and the issue is fixed in v3.6.4. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog (added 2026-03-20, patching deadline 2026-04-03), indicating confirmed exploitation in the wild, and EPSS assigns a 96.5% probability of exploitation within 30 days.

What to do: Upgrade Livewire to v3.6.4 or later immediately, as no workarounds are available. Audit Laravel applications for Livewire v3 usage and identify components mounted and configured in the vulnerable property-hydration pattern, prioritizing internet-facing apps. Federal agencies must apply vendor mitigations or discontinue use by the BOD 22-01 deadline of April 3, 2026.

Affected
laravel livewirev3 through v3.6.3 inclusive (fixed in v3.6.4; prior major versions such as v2 are not affected)
Estimated exposure
large≈10,000–100,000 Laravel application deployments (the subset of Livewire v3 installs using the vulnerable component mounting/property-update configuration) — Livewire is one of the most widely installed Laravel packages (tens of millions of package downloads), but only v3 deployments through 3.6.3 that mount and configure components in the specific vulnerable way are exposed, so the plausibly…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

CISA Known Exploited Vulnerability
Affected
Laravel Livewire
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due date
Ransomware use
Unknown
Vendors
laravel
Products
livewire
Weakness
CWE-94
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org CISA KEV GitHub PoCs EPSS (96.5%)

In the news