# CVE-2025-54068: Laravel Livewire Code Injection > Unauthenticated attackers can achieve remote code execution in Livewire v3 via property hydration if components are configured specifically. - **Severity:** Critical 9.2 (`CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) - **Exploited in the wild:** Yes, since 20 Mar 2026 (CISA KEV) - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 17 Jul 2025 - **Updated:** 23 Mar 2026 - **Also known as:** CLSA-2025-1761871972, GHSA-29cq-5w36-x7w3 ## What is CVE-2025-54068? CVE-2025-54068 is a critical code injection vulnerability in livewire, published on 17 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available. Weakness: CWE-94 (Improper Control of Generation of Code) ## Which versions are affected by CVE-2025-54068? 2 open source packages ship an affected version, including livewire/livewire. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `livewire/livewire` | Packagist | From 3.0.0-beta.1 | 3.6.4 | | `livewire/livewire` | Packagist | From 3.0.0-beta.1 | 3.6.4 | Products: Laravel Livewire. ## How do I fix CVE-2025-54068? Upgrade livewire/livewire to 3.6.4 or later. US federal agencies must fix it by 3 Apr 2026. ## Is CVE-2025-54068 being exploited? Yes. Attackers have exploited CVE-2025-54068 in the wild since at least 20 Mar 2026. Public exploit code: - A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APP_KEY of the Livewire project is known. (github_poc): https://github.com/synacktiv/Livepyre - High-interaction honeypot mimicking a vulnerable Laravel/Livewire app. Captures RCE exploits and webshells targeting CVE-2024-47823, CVE-2025-54068, and CVE-2025-14894, then analyzes them in sandboxed Docker containers to extract IOCs. (github_poc): https://github.com/HelgeSverre/livewire-honeypot - A tool designed to exploit CVE-2025-54068 and Remote Command Execution of the Livewire project. (github_poc): https://github.com/haxorstars/CVE-2025-54068 - Fast Python scanner detects vulnerable Laravel Livewire v3 sites (CVE-2025-54068, CVSS 9.2). Separates risky sites into vuln.txt, safe sites into safe.txt. (github_poc): https://github.com/e4zyy/Project-CVE-2025-54068 - https://github.com/flame-11/CVE-2025-54068-livewire (github_poc): https://github.com/flame-11/CVE-2025-54068-livewire - Test target: fresh Laravel 12 app with Livewire pinned to vulnerable 3.6.3 (CVE-2025-54068) for recon scanning (github_poc): https://github.com/luisdalmolin/recon-test-livewire ## Other vulnerabilities in livewire - [CVE-2024-22859](https://insights.sbomify.com/CVE-2024-22859/): Cross-site request forgery in n/a (high 8.8) - [CVE-2024-47823](https://insights.sbomify.com/CVE-2024-47823/): Livewire Remote Code Execution (RCE) on File Uploads (high 7.7) - [CVE-2024-21504](https://insights.sbomify.com/CVE-2024-21504/): Cross-site Scripting in livewire/livewire (medium 6.1) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2025-54068 and fix it if it is affected. What it is: CVE-2025-54068 is a critical code injection vulnerability in livewire, published on 17 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: Yes. Attackers have exploited CVE-2025-54068 in the wild since at least 20 Mar 2026. Affected packages and fixed versions: - livewire/livewire (Packagist): affected from 3.0.0-beta.1; fixed in 3.6.4 - livewire/livewire (Packagist): affected from 3.0.0-beta.1; fixed in 3.6.4 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2025-54068/ (Markdown: https://insights.sbomify.com/CVE-2025-54068/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-54068 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-54068 - OSV: https://osv.dev/vulnerability/CVE-2025-54068 --- From sbomify Insights: https://insights.sbomify.com/CVE-2025-54068/ Summaries are generated and may contain mistakes; the official description above is the record.