Laravel Livewire 3.6.3 Code Injection

Laravel Livewire versions from 3.0.0-beta.1 through 3.6.3 contain a code injection vulnerability during component property hydration that may allow unauthenticated remote code execution...

CVE-2025-54068: Improper Control of Generation of Code

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is...