Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5sj5-knp7-93e3
Vulnerability ID VCID-5sj5-knp7-93e3
Aliases CVE-2025-54068
GHSA-29cq-5w36-x7w3
Summary Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.58885 https://api.first.org/data/v1/epss?cve=CVE-2025-54068
epss 0.58885 https://api.first.org/data/v1/epss?cve=CVE-2025-54068
cvssv3.1 9.8 https://github.com/livewire/livewire
cvssv4 9.2 https://github.com/livewire/livewire
generic_textual CRITICAL https://github.com/livewire/livewire
cvssv3.1 9.8 https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
cvssv4 9.2 https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
generic_textual CRITICAL https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
ssvc Attend https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
cvssv3.1 9.8 https://github.com/livewire/livewire/releases/tag/v3.6.4
cvssv4 9.2 https://github.com/livewire/livewire/releases/tag/v3.6.4
generic_textual CRITICAL https://github.com/livewire/livewire/releases/tag/v3.6.4
ssvc Attend https://github.com/livewire/livewire/releases/tag/v3.6.4
cvssv3.1 9.8 https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
cvssv4 9.2 https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
generic_textual CRITICAL https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
ssvc Attend https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2025-54068
cvssv4 9.2 https://nvd.nist.gov/vuln/detail/CVE-2025-54068
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2025-54068
cvssv3.1 9.8 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068
cvssv4 9.2 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068
generic_textual CRITICAL https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068
cvssv3.1 9.8 https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas
cvssv4 9.2 https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas
generic_textual CRITICAL https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-54068
https://github.com/livewire/livewire
https://nvd.nist.gov/vuln/detail/CVE-2025-54068
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068
https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas
ef04be759da41b14d2d129e670533180a44987dc https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
GHSA-29cq-5w36-x7w3 https://github.com/advisories/GHSA-29cq-5w36-x7w3
GHSA-29cq-5w36-x7w3 https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
v3.6.4 https://github.com/livewire/livewire/releases/tag/v3.6.4
Data source KEV
Date added March 20, 2026
Description Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due date April 3, 2026
Note 
https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 ; https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc ; https://nvd.nist.gov/vuln/detail/CVE-2025-54068
Ransomware campaign use Unknown
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/livewire/livewire
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/livewire/livewire
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2026-03-21T04:01:26Z/ Found at https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/livewire/livewire/releases/tag/v3.6.4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/livewire/livewire/releases/tag/v3.6.4
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2026-03-21T04:01:26Z/ Found at https://github.com/livewire/livewire/releases/tag/v3.6.4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2026-03-21T04:01:26Z/ Found at https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-54068
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-54068
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.98258
EPSS Score 0.58885
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:56:20.528847+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/54xxx/CVE-2025-54068.json 38.6.0