Servers and applications
CVE-2025-54068
Livewire remote command execution during property update hydration
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 20 Mar 2026.
- Severity
- Critical 9.2
- Published
- 17 Jul 2025
- Last changed
- 7 Aug 2025
- Added to UpHeron
- 3 Nov 2026
- Fixed in
- 3.6.3
- Also known as
- GHSA-29cq-5w36-x7w3
- Sources
- Project advisories (GitHub)
Affected software
| Software | Affected versions |
|---|---|
LivewireServers and applications · github:livewire/livewire |
|
Known exploited
- CISA name
- Laravel Livewire Code Injection Vulnerability
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due for US agencies
- 3 Apr 2026
- Used in ransomware
- Not known
References
- CVE.org https://www.cve.org/CVERecord?id=CVE-2025-54068
- GitHub Advisory Database https://github.com/advisories/GHSA-29cq-5w36-x7w3
- github.com https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3