Livewire v3.6.3 Remote Command Execution Vulnerability Patched

Detected March 20th, 2026

Summary

CISA has issued a notice regarding a critical remote command execution vulnerability (CVE-2025-54068) in Livewire v3 up to v3.6.3. The vulnerability, which affects specific configurations and does not require authentication, has been patched in version 3.6.4.

View original document View source feed page

What changed

CISA is alerting users to a critical vulnerability (CVE-2025-54068) affecting Livewire, a full-stack framework for Laravel. Versions of Livewire v3 up to and including v3.6.3 are susceptible to unauthenticated remote command execution due to improper handling of component property updates. The vulnerability has a CVSS score of 9.2 and is categorized as CRITICAL. The issue has been patched in Livewire v3.6.4.

Affected entities, primarily technology companies utilizing Livewire v3, are strongly urged to upgrade to version 3.6.4 or later immediately, as no workarounds are available. Failure to update could expose systems to exploitation, leading to code injection and potential system compromise. The CISA Known Exploited Vulnerabilities (KEV) catalog also lists this vulnerability, indicating active exploitation or high confidence in exploitation potential.

What to do next

Upgrade Livewire to version 3.6.4 or later
Review component configurations for potential exploitation scenarios

Source document (simplified)

Required CVE Record Information

CNA: GitHub (maintainer security advisories)

Description

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

CWE 1 Total

Learn more
- CWE-94: CWE-94: Improper Control of Generation of Code ('Code Injection')

CVSS 1 Total

Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 9.2 | CRITICAL | 4.0 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |

Product Status

Learn more Versions 1 Total

Default Status: unknown

affected

affected at >= 3.0.0-beta.1, < 3.6.4

References 3 Total

Authorized Data Publishers

Learn more

CISA-ADP

Updated:

2026-03-20

SSVC and KEV, plus CVSS and CWE if not provided by the CNA.

SSVC 1 Total

Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| none | no | total | 2.0.3 | 2025-07-17 |