GHSA-qwvp-268g-jjm8
Data Leakage Vulnerability in livewire/livewire
GHSA-qwvp-268g-jjm8 is a vulnerability with no CVSS score yet in livewire/livewire, published May 15, 2024. No source lists public exploit code. Fixed in livewire/livewire 2.2.6.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.2.6livewire/livewire +1 more
Description
livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The $this->validate() method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
livewire/livewirePackagist | 2.2.5 up to 2.2.6 | 2.2.6 |
livewire/livewirePackagist | 2.2.5 up to 2.2.6, plus listed versions v2.2.5 | 2.2.6 |
What each source reports
GitHub AdvisoriesNo score
Data Leakage Vulnerability in livewire/livewire
livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The $this->validate() method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.
- Record
GHSA-qwvp-268g-jjm8- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
Data Leakage Vulnerability in livewire/livewire
livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The $this->validate() method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.
- Record
GHSA-qwvp-268g-jjm8- Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.