CVEs / CVE-2025-54068
CVE-2025-54068: Laravel Livewire Code Injection Vulnerability
- Known exploited in the CISA KEV catalog since 20 Mar 2026
- critical 9.8 CVSS 3.1 (NVD)
- EPSS 96.2% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2025-54068
Summary
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
Description
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| livewire livewire | >= 3.0.0-beta.1, < 3.6.4 | — |
| Product | Affected | Fixed in |
|---|---|---|
| livewire/livewire (Packagist) | from 3.0.0-beta.1, before 3.6.4 | 3.6.4 |
Package versions from GHSA-29cq-5w36-x7w3.
Exploitation
| In CISA KEV since | 20 Mar 2026 |
|---|---|
| Due date for US federal agencies | 3 Apr 2026 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-94 |
References
- CVE-2025-54068 on NVD
- CVE-2025-54068 in the CISA KEV catalog
- https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 (cited by CISA)
- https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc (cited by CISA)
- CVE-2025-54068 on OSV
- https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc Patch
- https://github.com/livewire/livewire/releases/tag/v3.6.4 Release Notes
- https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068 US Government Resource
- https://www.threathunter.ai/blog/iranian-threat-actor-tools-techniques-iocs-ioas/ Third Party Advisory
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.