Research · Jul 17, 2025 · ZeroDay Catalog
Critical Code Injection Vulnerability in Laravel Livewire
A critical code injection vulnerability has been identified in Laravel Livewire v3 up to 3.6.3, allowing unauthenticated remote command execution. Users are urged to upgrade to v3.6.4 immediately.
What changed
A significant vulnerability has been discovered in Laravel Livewire, a full-stack framework for Laravel. This flaw allows unauthenticated attackers to execute remote commands under specific conditions, particularly in versions up to v3.6.3.
The vulnerability arises from the way certain component property updates are managed during hydration, making it possible for attackers to exploit this flaw without needing authentication or user interaction.
- The vulnerability is exclusive to Livewire v3 and does not impact earlier major versions.
- The issue has been addressed in Livewire version 3.6.4, which users are strongly encouraged to adopt.
Who is affected
Organizations utilizing Laravel Livewire v3 versions up to 3.6.3 are at risk of this vulnerability. The following groups are particularly affected:
Developers and businesses relying on Laravel Livewire for their applications should be aware of this issue and take immediate action.
- Users of Laravel Livewire v3 up to and including v3.6.3.
- Developers who have integrated Livewire into their Laravel applications.
- Organizations that have deployed applications using the affected versions without proper security measures.
What to do
It is crucial for all users of Laravel Livewire v3 to upgrade to version 3.6.4 or later as soon as possible to mitigate the risk of exploitation. Failure to act may leave systems vulnerable to remote command execution attacks.
Additionally, users should review their application configurations to ensure that components are not exposed unnecessarily.
- Upgrade Laravel Livewire to version 3.6.4 or later immediately.
- Review and secure application configurations to minimize exposure.
- Monitor for any unusual activity that may indicate exploitation attempts.