{"id":"GHSA-qwvp-268g-jjm8","aliases":[],"status":"published","title":"Data Leakage Vulnerability in livewire/livewire","description":"livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The `$this-\u003evalidate()` method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-05-15T22:28:49Z","modified":"2024-11-29T05:28:26Z","fixes":[{"ecosystem":"Packagist","package":"livewire/livewire","fixed_in":["2.2.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"livewire/livewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.5"},{"fixed":"2.2.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"livewire/livewire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.5"},{"fixed":"2.2.6"}]}],"versions":["v2.2.5"]}],"references":[{"url":"https://github.com/livewire/livewire/commit/6929f5882138a98187c196ce66cc689712c000af","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/livewire/livewire/2020-09-22-1.yaml","tags":["web"]},{"url":"https://github.com/livewire/livewire/releases/tag/v2.2.6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qwvp-268g-jjm8"},{"url":"https://github.com/livewire/livewire","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-qwvp-268g-jjm8","title":"Data Leakage Vulnerability in livewire/livewire","description":"livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The `$this-\u003evalidate()` method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.\n\n","status":"published","published":"2024-05-15T22:28:49Z","modified":"2024-05-15T22:28:51Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:49.987036Z"}],"osv":[{"id":"GHSA-qwvp-268g-jjm8","title":"Data Leakage Vulnerability in livewire/livewire","description":"livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The `$this-\u003evalidate()` method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.\n\n","status":"published","published":"2024-05-15T22:28:49Z","modified":"2024-11-29T05:28:26.022746Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}