Laravel · Livewire
Laravel Livewire v3 (up to and including v3.6.3) contains a code injection flaw in how certain component property updates are hydrated, affecting the Livewire framework component handling. An unauthenticated remote attacker can achieve remote command execution when a component is mounted and configured in a particular way, without requiring authentication or user interaction.
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
First seen exploited 8 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 5 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
4 fixes in livewire/livewire over 2 years. The latest fix listed for livewire/livewire is 4.3.4.
unauthenticated remote attack on public app
allows unauthenticated attackers to achieve remote command execution
command execution is the direct impact
achieve remote command execution
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: livewire/livewire.
Upgrade to 3.6.4 or later
Set the version to 3.6.4 or later in your composer.json.
The first fix for CVE-2025-54068. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 3.0.0-beta.1 up to 3.6.4 | 3.6.4 |
“Up to” means the second version is the fix and is not affected.
Reports are matched by finding the exact id CVE-2025-54068 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.