Laravel Livewire v3 Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2025-54068)

No official workarounds are available for this vulnerability. Immediate package upgrade is highly recommended.

1. Upgrade via Composer

Run the following command in your project root directory to upgrade Livewire to a secure version (v3.6.4 or later):

composer update livewire/livewire

Verify that your composer.json and composer.lock reflect the patched version:

"require": {
    "livewire/livewire": "^3.6.4"
}

2. Temporary WAF Mitigation

If immediate patching is not possible, configure Web Application Firewall (WAF) rules to inspect and block suspicious serialization payloads and command injection patterns targeting the Livewire update endpoint (/livewire/update).

A critical Remote Code Execution (RCE) vulnerability has been identified in Livewire v3, a full-stack framework for Laravel. The vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios.

Root Cause & Exploit Mechanics (CWE-94)

The issue stems from how certain component property updates are hydrated during the state synchronization process between the client and the server. When a component is mounted and configured in a specific manner, lack of proper input validation allows an attacker to inject malicious payloads that are executed on the server side during the hydration phase. No authentication or user interaction is required to trigger this vulnerability.

Severity & Active Exploitation

With a CVSS score of 9.8 (Critical), this vulnerability poses an extreme risk. It has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively exploiting this flaw in the wild.