Vulnerability details

CVE-2025-54068

Actively exploited

livewire livewire

Livewire vulnerable to remote command execution during property update hydration

CVSS 4.0

9.2Critical

Remedy

Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2026-04-03)

Official description

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

CVSS scores

Score	Version	Source	Vector
9.2Critical	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
livewire	livewire	>= 3.0.0-beta.1, < 3.6.4	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 x_refsource_CONFIRM
https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc x_refsource_MISC
https://github.com/livewire/livewire/releases/tag/v3.6.4 x_refsource_MISC
https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas/ third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-07-17
Last updated: 2026-03-23
State: Published
Assigner (CNA): GitHub_M
Kolun priority: 79 · High

CISA KEV catalog

Date added: 2026-03-20
Due date: 2026-04-03
Used in ransomware: Unknown

Exploit prediction (EPSS)

96.28%

Probability of exploitation in 30 days

99.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-94
Improper Control of Generation of Code ('Code Injection')