{"answers":{"affected":"2 open source packages ship an affected version, including livewire/livewire. It affects 1 product.","exploited":"Yes. Attackers have exploited CVE-2025-54068 in the wild since at least 20 Mar 2026.","fix":"Upgrade livewire/livewire to 3.6.4 or later. US federal agencies must fix it by 3 Apr 2026.","what":"CVE-2025-54068 is a critical code injection vulnerability in livewire, published on 17 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-54068 and fix it if it is affected.\n\nWhat it is: CVE-2025-54068 is a critical code injection vulnerability in livewire, published on 17 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: Yes. Attackers have exploited CVE-2025-54068 in the wild since at least 20 Mar 2026.\n\nAffected packages and fixed versions:\n- livewire/livewire (Packagist): affected from 3.0.0-beta.1; fixed in 3.6.4\n- livewire/livewire (Packagist): affected from 3.0.0-beta.1; fixed in 3.6.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-54068/ (Markdown: https://insights.sbomify.com/CVE-2025-54068/index.md)","id":"CVE-2025-54068","markdown":"https://insights.sbomify.com/CVE-2025-54068/index.md","name":"CVE-2025-54068","record":{"aliases":["CLSA-2025-1761871972","GHSA-29cq-5w36-x7w3"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Livewire Laravel framework","requires_auth":"none","summary":"Unauthenticated attackers can achieve remote code execution in Livewire v3 via property hydration if components are configured specifically.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"livewire","vendor":"laravel"}],"cvss":{"score":9.2,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"description":"Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":"2025-12-23","github_poc":7,"max_poc_stars":154,"metasploit":0,"nuclei":1,"refs":[{"date":"2025-12-23T09:54:54Z","kind":"github_poc","ref":"https://github.com/synacktiv/Livepyre","stars":154,"title":"A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APP_KEY of the Livewire project is known."},{"date":"2026-04-10T09:21:26Z","kind":"github_poc","ref":"https://github.com/HelgeSverre/livewire-honeypot","stars":8,"title":"High-interaction honeypot mimicking a vulnerable Laravel/Livewire app. Captures RCE exploits and webshells targeting CVE-2024-47823, CVE-2025-54068, and CVE-2025-14894, then analyzes them in sandboxed Docker containers to extract IOCs."},{"date":"2026-01-20T14:10:56Z","kind":"github_poc","ref":"https://github.com/haxorstars/CVE-2025-54068","stars":5,"title":"A tool designed to exploit CVE-2025-54068 and Remote Command Execution of the Livewire project."},{"date":"2026-01-01T12:28:22Z","kind":"github_poc","ref":"https://github.com/e4zyy/Project-CVE-2025-54068","stars":4,"title":"Fast Python scanner detects vulnerable Laravel Livewire v3 sites (CVE-2025-54068, CVSS 9.2). Separates risky sites into vuln.txt, safe sites into safe.txt."},{"date":"2026-01-08T03:42:08Z","kind":"github_poc","ref":"https://github.com/flame-11/CVE-2025-54068-livewire","stars":1,"title":null},{"date":"2026-07-06T19:59:02Z","kind":"github_poc","ref":"https://github.com/luisdalmolin/recon-test-livewire","stars":0,"title":"Test target: fresh Laravel 12 app with Livewire pinned to vulnerable 3.6.3 (CVE-2025-54068) for recon scanning"},{"date":"2026-10-17T03:10:21Z","kind":"github_poc","ref":"https://github.com/GustavoLopreto/cve-2025-54068-vuln-intel","stars":0,"title":"Inteligencia de vulnerabilidade sobre o RCE no Laravel Livewire: CVSS v4 do zero e priorizacao com EPSS/KEV."},{"date":null,"kind":"nuclei","ref":"http/cves/2025/CVE-2025-54068.yaml","stars":null,"title":"Laravel Livewire v3 - Remote Command Execution"}],"tier":"exploited"},"has_fix":true,"headline":"Laravel Livewire Code Injection","id":"CVE-2025-54068","indexable":true,"kev":{"dateAdded":"2026-03-20","dueDate":"2026-04-03","knownRansomwareCampaignUse":"Unknown","product":"Livewire","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","vendorProject":"Laravel","vulnerabilityName":"Laravel Livewire Code Injection Vulnerability"},"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"code_injection","year":"2025"},"n_packages":2,"n_references":3,"next":{"headline":"OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers","id":"CVE-2025-54070"},"packages":[{"ecosystem":"Packagist","fixed":["3.6.4"],"introduced":["3.0.0-beta.1"],"last_affected":[],"package":"livewire/livewire","purl":null,"source":"GHSA-29cq-5w36-x7w3"},{"ecosystem":"Packagist","fixed":["3.6.4"],"introduced":["3.0.0-beta.1"],"last_affected":[],"package":"livewire/livewire","purl":"pkg:composer/livewire/livewire","source":"GHSA-29cq-5w36-x7w3"}],"prev":{"headline":"DiracX-Web login page has Open Redirect vulnerability","id":"CVE-2025-54066"},"products":["livewire"],"published":"2025-07-17","related":[{"cvss_score":8.8,"headline":"Cross-site request forgery in n/a","id":"CVE-2024-22859","kev_date_added":null,"published":"2024-02-01"},{"cvss_score":7.7,"headline":"Livewire Remote Code Execution (RCE) on File Uploads","id":"CVE-2024-47823","kev_date_added":null,"published":"2024-10-08"},{"cvss_score":6.1,"headline":"Cross-site Scripting in livewire/livewire","id":"CVE-2024-21504","kev_date_added":null,"published":"2024-03-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-03-23","vendors":["livewire"]},"summary":"Unauthenticated attackers can achieve remote code execution in Livewire v3 via property hydration if components are configured specifically.","url":"https://insights.sbomify.com/CVE-2025-54068/"}