Livewire vulnerable to remote command execution during property update hydration
Livewire v3 from 3.0.0-beta.1 through 3.6.3 is affected only in certain component setups. The fix is in 3.6.4.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 3.6.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Livewire, a full-stack framework for Laravel applications, is affected by this vulnerability, which allows an unauthenticated remote attacker to execute arbitrary commands on the server in certain component configurations. Successful exploitation could give an attacker full control over the affected server and the data it hosts.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- livewire livewire
From 3.0.0-beta.1 · fixed in 3.6.4
- livewire/livewirePackagist
From 3.0.0-beta.1 · fixed in 3.6.4
References 3
GitHub · livewire/livewire
Questions about CVE-2025-54068
What does this mean?
The bug lets an unauthenticated remote party run commands on the affected system during property update hydration, in specific scenarios.Source: github.com
Am I affected, and how do I check?
Livewire v3 versions from 3.0.0-beta.1 up to and including 3.6.3 are in scope, and only when a component is mounted and configured in a particular way. Check the installed version with composer show livewire/livewire or in composer.lock, and review how components are mounted and configured.Source: github.com
What should I do about it?
Upgrade Livewire to 3.6.4 or later.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-03-20, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data