🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2025-54068

9.2

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

livewire

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

Laravel Livewire v3 - Remote Command Execution

Livewire v3 (Laravel) contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution (RCE) without authentication under certain conditions. References: https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 https://github.com/synacktiv/Livepyre https://www.synacktiv.com/en/publications/livewire-remote-command-execution-through-unmarshaling https://www.synacktiv.com/sites/default/files/2025-09/slides-livewire-nullcon2025.pdf https://nvd.nist.gov/vuln/detail/CVE-2025-54068 Remediation: Upgrade livewire/livewire to a patched version (>= 3.6.4).

url

Scanner page →Run scanner

CVE history: livewire

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →