CVE-2025-54068 Laravel Livewire Code Injection

What is CVE-2025-54068?

CVE-2025-54068 is a critical code injection vulnerability in livewire, published on 17 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

Weakness: CWE-94

Which versions are affected by CVE-2025-54068?

2 open source packages ship an affected version, including livewire/livewire. It affects 1 product.

Products include Laravel Livewire.

How do I fix CVE-2025-54068?

Upgrade livewire/livewire to 3.6.4 or later. US federal agencies must fix it by 3 Apr 2026.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-54068 being exploited?

Yes. Attackers have exploited CVE-2025-54068 in the wild since at least 20 Mar 2026.

Public exploit code: 1 Nuclei template and 7 proofs of concept on GitHub.

Other vulnerabilities in livewire

• CVE-2024-22859 Cross-site request forgery in n/a High 8.8
• CVE-2024-47823 Livewire Remote Code Execution (RCE) on File Uploads High 7.7
• CVE-2024-21504 Cross-site Scripting in livewire/livewire Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2025-1761871972, GHSA-29cq-5w36-x7w3.