Loading...
Skip to main content
GeekWala

CVE-2025-54068 — Vulnerability in livewire/livewire — CVE Details

CRITICAL
Actively Exploited

Livewire is vulnerable to remote command execution during component property update hydration

Published July 17, 2025Updated March 20, 2026Source: osv

What Should I Do?

Patch Immediately

This vulnerability is confirmed under active exploitation (CISA KEV). Patch within 24-48 hours if possible.

Summary

### Impact In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. ### Patches This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. ### Workarounds There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately. ### Resources No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.

Advisory Timeline

  • First published July 17, 2025 (452 days ago).
  • Last revised March 20, 2026 — 246 days after initial publication.
  • Added to CISA's Known Exploited Vulnerabilities catalog 245 days after publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update livewire/livewire to 3.6.4 or later
composer require "livewire/livewire:^3.6.4"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
livewire/livewire
packagist
v3.0.0, v3.0.0-beta.1, v3.0.0-beta.10, v3.0.0-beta.11 (+70 more)3.6.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-54068?
Livewire is vulnerable to remote command execution during component property update hydration This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2025-54068?
CVE-2025-54068 affects livewire/livewire. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-54068 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Known Exploited Vulnerability

This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Added to KEV catalog: March 20, 2026

Remediation deadline: April 3, 2026

Also Known As

GHSA-29cq-5w36-x7w3

Related CVEs

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies