CVE-2025-54068
Livewire vulnerable to remote command execution during property update hydration
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Livewire vulnerable to remote command execution during property update hydration
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
- Record
CVE-2025-54068- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2025-21792
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
- Record
EUVD-2025-21792- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-29cq-5w36-x7w3
Livewire is vulnerable to remote command execution during component property update hydration
Impact
In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.
Patches
This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible.
Workarounds
There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.
Resources
No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.
- Record
GHSA-29cq-5w36-x7w3- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
CISA KEV No score
Laravel Livewire Code Injection Vulnerability
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
- Record
CVE-2025-54068- Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
- Record
CVE-2025-54068- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Livewire vulnerable to remote command execution during property update hydration
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
- Record
CVE-2025-54068- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-29cq-5w36-x7w3
Livewire is vulnerable to remote command execution during component property update hydration
Impact
In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.
Patches
This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible.
Workarounds
There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.
Resources
No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.
- Record
GHSA-29cq-5w36-x7w3- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVCLSA-2025-1761871972 No score
TuxCare security update for livewire/livewire (1 CVE)
TuxCare rebuilt livewire/livewire to address 1 CVE. Fixed in v3.6.3-p1+tuxcare.
- Record
CLSA-2025-1761871972- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
livewire/livewirePackagist |
3.0.0-beta.1 up to 3.6.4 | 3.6.4 |
livewire/livewireTuxCare:Packagist |
v3.6.3 up to v3.6.3-p1+tuxcare | v3.6.3-p1+tuxcare |
livewire/livewirePackagist |
3.0.0-beta.1 up to 3.6.4, plus listed versions v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.2 Show 45 moreShow lessv3.0.0-beta.3v3.0.0-beta.4v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9v3.0.1v3.0.10v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.2.0v3.2.1v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.3.0v3.3.1v3.3.2v3.3.3v3.3.4v3.3.5v3.4.0v3.4.1v3.4.10v3.4.11v3.4.12v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v3.5.0 |
3.6.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | synacktiv/Livepyre | 2025-12-23 |
| PoC in GitHub | e4zyy/Project-CVE-2025-54068 | 2026-01-01 |
| PoC in GitHub | flame-11/CVE-2025-54068-livewire | 2026-01-08 |
| PoC in GitHub | haxorstars/CVE-2025-54068 | 2026-01-20 |
| PoC in GitHub | HelgeSverre/livewire-honeypot | 2026-04-10 |
| PoC in GitHub | luisdalmolin/recon-test-livewire | 2026-07-06 |
| PoC in GitHub | GustavoLopreto/cve-2025-54068-vuln-intel | 2026-10-17 |
| Nuclei | Laravel Livewire v3 - Remote Command Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-54068 is a critical vulnerability (CVSS 9.2) in Laravel Livewire, published July 17, 2025. CISA lists it as known to be exploited, since March 20, 2026. EUVD reports exploitation since March 20, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.3%, the 99th percentile. Fixed in livewire/livewire 3.6.4.
References
github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068
nvd.nist.gov/vuln/detail/CVE-2025-54068
Left out here: 24 versions. The JSON record has them.