Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

Livewire is a full-stack framework for Laravel that makes building dynamic interfaces simple, without leaving the comfort of Laravel.

A remote code execution vulnerability exists in Livewire versions prior to 3.6.4 due to improper handling of serialized data during the component hydration process. An attacker can exploit this vulnerability by sending a specially crafted request containing malicious serialized data to the server, which is then deserialized and executed, allowing the attacker to execute arbitrary code on the server.

Note: Depending on the identified version of Livewire, the plugin indicates that the website is **potentially** vulnerable if it uses version 3.6.3 (vulnerable) or 3.6.4 (patched).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability
    allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue
    stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire
    v3 and does not affect prior major versions. Exploitation requires a component to be mounted and
    configured in a particular way, but does not require authentication or user interaction. This issue has
    been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as
    soon as possible. No known workarounds are available. (CVE-2025-54068)

ID	Name	Product	Family	Severity
115113	Livewire 3.x < 3.6.4 Remote Code Execution	Web App Scanning	Component Vulnerability	critical
428439	SCA: security update for livewire/livewire (GHSA-29cq-5w36-x7w3)	Tenable Cloud Security	SCA Checks	critical
428439	SCA: security update for livewire/livewire (GHSA-29cq-5w36-x7w3)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2025-54068

critical

Tenable Plugins

critical

critical

critical