livewire/livewire

A full-stack framework for Laravel that takes the pain out of building dynamic UIs.

View on Packagist

View on Github

Activity

Latest release: 1w ago
Total releases: 320
Cadence: ~daily
Last 12 months: 63

Reach

Stars: 23.6k

Details

License: MIT
First release: Apr 15, 2019

Releases

Version	Released
`v4.4.8` patch	Oct 21, 2026
`v3.8.11` patch	Oct 21, 2026
`v4.4.7` patch 1 CVE	Sep 28, 2026
`v3.8.10` patch	Sep 28, 2026
`v4.4.6` patch 1 CVE	Sep 21, 2026
`v3.8.9` patch	Sep 14, 2026
`v4.4.5` patch 1 CVE	Sep 14, 2026
`v4.4.4` patch 1 CVE	Sep 07, 2026
`v3.8.8` patch	Sep 07, 2026
`v4.4.3` patch 1 CVE	Aug 31, 2026
`v3.8.7` patch	Aug 31, 2026
`v4.4.2` patch 1 CVE	Aug 24, 2026
`v3.8.6` patch	Aug 24, 2026
`v4.4.1` patch 1 CVE	Aug 18, 2026
`v3.8.5` patch	Aug 18, 2026
`v4.4.0` minor 1 CVE	Aug 10, 2026
`v3.8.4` patch	Aug 10, 2026
`v4.3.5` patch 1 CVE	Aug 03, 2026
`v4.3.4` patch 1 CVE	Jul 31, 2026
`v3.8.3` patch	Jul 31, 2026
`v4.3.3` patch 2 CVEs	Jun 27, 2026
`v3.8.2` patch 1 CVE	Jun 27, 2026
`v4.3.2` patch 2 CVEs	Jun 26, 2026
`v4.3.1` patch 2 CVEs	Jun 02, 2026
`v3.8.1` patch 1 CVE	Jun 02, 2026
`v4.3.0` minor 2 CVEs	May 01, 2026
`v3.8.0` minor 1 CVE	Apr 30, 2026
`v3.7.15` patch 1 CVE	Apr 03, 2026
`v3.7.14` patch 1 CVE	Apr 02, 2026
`v3.7.14-beta.1` pre 1 CVE	Apr 02, 2026
`v4.2.4` patch 1 CVE	Apr 02, 2026
`v4.2.4-beta.2` pre 1 CVE	Apr 02, 2026
`v4.2.3` patch 1 CVE	Mar 30, 2026
`v3.7.13` patch 1 CVE	Mar 30, 2026
`v4.2.2` patch 1 CVE	Mar 25, 2026
`v3.7.12` patch 1 CVE	Mar 25, 2026
`v4.2.1` patch 1 CVE	Feb 28, 2026
`v4.2.0` minor 1 CVE	Feb 26, 2026
`v3.7.11` patch 1 CVE	Feb 26, 2026
`v4.1.4` patch 1 CVE	Feb 09, 2026
`v3.7.10` patch 1 CVE	Feb 09, 2026
`v4.1.3` patch 1 CVE	Feb 06, 2026
`v3.7.9` patch 1 CVE	Feb 05, 2026
`v4.1.2` patch 1 CVE	Feb 03, 2026
`v3.7.8` patch 1 CVE	Feb 03, 2026
`v4.1.1` patch 1 CVE	Feb 03, 2026
`v3.7.7` patch 1 CVE	Feb 02, 2026
`v4.1.0` minor 1 CVE	Jan 27, 2026
`v4.0.3` patch 1 CVE	Jan 23, 2026
`v3.7.6` patch 1 CVE	Jan 23, 2026

1–50 of 320

Repository

livewire/livewire

Forks: 1.8k
Open issues: 23
Language: PHP
: 5.7/ 10

Dependencies (8)

Depends on

v4.4.8

Used by

2177

Supply-chain exposure

2,177 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (6)

GHSA-mhf7-xp6r-6qrc Oct 23, 2026

Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

6.5 / 10
Medium
Network Low Low None Unchanged None High None

Impact

Three issues allowed actions protected by the #[Authorize] attribute to run against records the current user is not authorized for:

Out-of-order parameter keys on actions. #[Authorize] resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. {"1": 2, "0": 1}) could pass authorization with a record the user owns while the action received a different record. With #[Authorize('delete', 'comment')] on deleteComment(Comment $comment), a user could delete another user's comment.

The same issue on event listeners. Methods using both #[On] and #[Authorize] with a model parameter were affected in the same way through the __dispatch call.

#[Json] methods ran before authorization. When a method had both #[Json] and #[Authorize], the method body executed before the authorization check. The response was still a 403, but any side effects (such as database writes) had already happened.

Only applications using the #[Authorize] attribute are affected: on methods that take model parameters (issues 1 and 2), or on #[Json] methods (issue 3). Authorization performed inside the method (e.g. $this->authorize(...)) is not affected. Livewire 3.x is not affected.

Patches

Fixed in v4.4.8. Call and event parameters must now be a list or use named (string) keys, otherwise the request is rejected, and #[Json] methods are authorized before they run.

Workarounds

Upgrade to v4.4.8. If you can't upgrade right away, call $this->authorize(...) inside affected methods instead of relying on the #[Authorize] attribute.

Credits

Reported by Yousef Aman (@yousef-aman).

Affected versions

v4.3.0v4.3.1v4.3.2v4.3.3v4.3.4v4.3.5v4.4.0v4.4.1v4.4.2v4.4.3v4.4.4v4.4.5

+ 2 more Show less

v4.4.6v4.4.7

Fixed in

4.4.8

References

https://github.com/livewire/livewire/security/advisories/GHSA-mhf7-xp6r-6qrc
https://github.com/livewire/livewire/commit/822a4fa9b1e1123691133a2e2eb379a3dab11191
https://github.com/livewire/livewire
https://github.com/livewire/livewire/releases/tag/v4.4.8

Updated Oct 23, 2026 · Source: OSV.dev
CVE-2026-81887 GHSA-g3hc-697w-wm82 Sep 02, 2026

Livewire DOM-based cross-site scripting during client-side state handling

Medium
Network Low None

Impact

In Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.

Patches

This issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.

Workarounds

There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.

Affected versions

v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.2v3.0.0-beta.3v3.0.0-beta.4v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9

+ 110 more Show less

v3.0.1v3.0.10v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.2.0v3.2.1v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.3.0v3.3.1v3.3.2v3.3.3v3.3.4v3.3.5v3.4.0v3.4.1v3.4.10v3.4.11v3.4.12v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v3.5.0v3.5.1v3.5.10v3.5.11v3.5.12v3.5.13v3.5.14v3.5.15v3.5.16v3.5.17v3.5.18v3.5.19v3.5.2v3.5.20v3.5.3v3.5.4v3.5.5v3.5.6v3.5.7v3.5.8v3.5.9v3.6.0v3.6.1v3.6.2v3.6.3v3.6.4v3.7.0v3.7.0-beta.1v3.7.0-beta.2v3.7.1v3.7.10v3.7.11v3.7.12v3.7.13v3.7.14v3.7.14-beta.1v3.7.15v3.7.2v3.7.3v3.7.4v3.7.5v3.7.6v3.7.7v3.7.8v3.7.9v3.8.0v3.8.1v3.8.2v4.0.0v4.0.0-beta.1v4.0.0-beta.2v4.0.0-beta.3v4.0.0-beta.4v4.0.0-beta.5v4.0.0-beta.6v4.0.1v4.0.2v4.0.3v4.1.0v4.1.1v4.1.2v4.1.3v4.1.4v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.4-beta.2v4.3.0v4.3.1v4.3.2v4.3.3

Fixed in

3.8.34.3.4

References

https://github.com/livewire/livewire/security/advisories/GHSA-g3hc-697w-wm82
https://nvd.nist.gov/vuln/detail/CVE-2026-81887
https://github.com/livewire/livewire/pull/10467
https://github.com/livewire/livewire/commit/11ebe646f7e81dde2d714815da8b3019d058561e
https://github.com/livewire/livewire
https://github.com/livewire/livewire/releases/tag/v3.8.3

Updated Sep 02, 2026 · Source: OSV.dev
CVE-2025-54068 GHSA-29cq-5w36-x7w3 Jul 17, 2025

Livewire is vulnerable to remote command execution during component property update hydration

Critical
Network High None None

Impact

In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.

Patches

This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible.

Workarounds

There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.

Resources

No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.

Affected versions

v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.2v3.0.0-beta.3v3.0.0-beta.4v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9

+ 62 more Show less

v3.0.1v3.0.10v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.2.0v3.2.1v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.3.0v3.3.1v3.3.2v3.3.3v3.3.4v3.3.5v3.4.0v3.4.1v3.4.10v3.4.11v3.4.12v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v3.5.0v3.5.1v3.5.10v3.5.11v3.5.12v3.5.13v3.5.14v3.5.15v3.5.16v3.5.17v3.5.18v3.5.19v3.5.2v3.5.20v3.5.3v3.5.4v3.5.5v3.5.6v3.5.7v3.5.8v3.5.9v3.6.0v3.6.1v3.6.2v3.6.3

Fixed in

3.6.4

References

https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
https://nvd.nist.gov/vuln/detail/CVE-2025-54068
https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
https://github.com/livewire/livewire
https://github.com/livewire/livewire/releases/tag/v3.6.4
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068

Updated Mar 20, 2026 · Source: OSV.dev
CVE-2024-47823 GHSA-f3cx-396f-7jqp Oct 08, 2024

Livewire Remote Code Execution on File Uploads

High
Network Low Low None

In livewire/livewire prior to v2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., image/png) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack:

Filename is composed of the original file name using $file->getClientOriginalName()

Files stored directly on your server in a public storage disk

Webserver is configured to execute “.php” files

PoC

In the following scenario, an attacker could upload a file called shell.php with an image/png MIME type and execute it on the remote server.

class SomeComponent extends Component { use WithFileUploads; #[Validate('image|extensions:png')] public $file; public function save() { $this->validate(); $this->file->storeAs( path: 'images', name: $this->file->getClientOriginalName(), options: ['disk' => 'public'], ); } }

Affected versions

v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.2v3.0.0-beta.3v3.0.0-beta.4v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9

+ 217 more Show less

v3.0.1v3.0.10v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.2.0v3.2.1v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.3.0v3.3.1v3.3.2v3.3.3v3.3.4v3.3.5v3.4.0v3.4.1v3.4.10v3.4.11v3.4.12v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v3.5.0v3.5.1v0.0.1v0.0.10v0.0.11v0.0.12v0.0.13v0.0.14v0.0.15v0.0.2v0.0.3v0.0.4v0.0.5v0.0.6v0.0.7v0.0.8v0.0.9v0.1v0.1.1v0.1.2v0.1.3v0.1.4v0.1.5v0.1.6v0.2.0v0.2.1v0.2.10v0.2.2v0.2.3v0.2.4v0.2.5v0.2.6v0.2.7v0.2.8v0.2.9v0.3.0v0.3.1v0.3.10v0.3.11v0.3.12v0.3.13v0.3.14v0.3.15v0.3.16v0.3.17v0.3.18v0.3.19v0.3.2v0.3.20v0.3.21v0.3.3v0.3.4v0.3.5v0.3.6v0.3.7v0.3.8v0.3.9v0.4.0v0.5.0v0.5.1v0.5.2v0.5.3v0.6.0v0.7.0v0.7.1v0.7.2v0.7.3v0.7.4v1.0.0v1.0.1v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0v1.3.0v1.3.1v1.3.2v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9v2.0.0v2.0.1v2.0.2v2.0.3v2.0.4v2.1.0v2.1.1v2.1.2v2.1.3v2.1.4v2.10.0v2.10.1v2.10.2v2.10.3v2.10.4v2.10.5v2.10.6v2.10.7v2.10.8v2.11.0v2.11.1v2.11.2v2.11.3v2.12.0v2.12.1v2.12.2v2.12.3v2.12.4v2.12.5v2.12.6v2.2.0v2.2.1v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.1v2.4.2v2.4.3v2.4.4v2.5.0v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.7.0v2.7.1v2.7.2v2.8.0v2.8.1v2.8.2v2.9.0

Fixed in

2.12.73.5.2

References

https://github.com/livewire/livewire/security/advisories/GHSA-f3cx-396f-7jqp
https://nvd.nist.gov/vuln/detail/CVE-2024-47823
https://github.com/livewire/livewire/pull/8624
https://github.com/livewire/livewire/commit/70503b79f5db75a1eac9bf55826038a6ee5a16d5
https://github.com/livewire/livewire/commit/cd168c6212ea13d13b82b3132485741f82d9fad9
https://github.com/livewire/livewire

Updated Oct 10, 2024 · Source: OSV.dev
GHSA-qwvp-268g-jjm8 May 15, 2024

Data Leakage Vulnerability in livewire/livewire

Medium

livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The $this->validate() method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.

Affected versions

v2.2.5

Fixed in

2.2.6

References

https://github.com/livewire/livewire/commit/6929f5882138a98187c196ce66cc689712c000af
https://github.com/FriendsOfPHP/security-advisories/blob/master/livewire/livewire/2020-09-22-1.yaml
https://github.com/livewire/livewire
https://github.com/livewire/livewire/releases/tag/v2.2.6

Updated Nov 29, 2024 · Source: OSV.dev
CVE-2024-21504 GHSA-389c-cf87-qmwj Mar 19, 2024

Cross-site Scripting in livewire/livewire

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.

Affected versions

v3.3.5v3.4.0v3.4.1v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8

Fixed in

3.4.9

References

https://nvd.nist.gov/vuln/detail/CVE-2024-21504
https://github.com/livewire/livewire/pull/8117
https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0
https://github.com/livewire/livewire
https://github.com/livewire/livewire/releases/tag/v3.4.9
https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222

Updated Mar 20, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 4
minor 34
patch 260
pre 21

320 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More