livewire/livewire

A full-stack framework for Laravel that takes the pain out of building dynamic UIs.

View on Packagist

View on Github

Activity

Latest release: 1d ago
Total releases: 302
Cadence: ~daily
Last 12 months: 49

Reach

Stars: 23.6k

Details

License: MIT
First release: Apr 15, 2019

Releases

Version	Released
`v4.3.4` patch	Jul 31, 2026
`v3.8.3` patch	Jul 31, 2026
`v4.3.3` patch	Jun 27, 2026
`v3.8.2` patch	Jun 27, 2026
`v4.3.2` patch	Jun 26, 2026
`v4.3.1` patch	Jun 02, 2026
`v3.8.1` patch	Jun 02, 2026
`v4.3.0` minor	May 01, 2026
`v3.8.0` minor	Apr 30, 2026
`v3.7.15` patch	Apr 03, 2026
`v3.7.14` patch	Apr 02, 2026
`v3.7.14-beta.1` pre	Apr 02, 2026
`v4.2.4` patch	Apr 02, 2026
`v4.2.4-beta.2` pre	Apr 02, 2026
`v4.2.3` patch	Mar 30, 2026
`v3.7.13` patch	Mar 30, 2026
`v4.2.2` patch	Mar 25, 2026
`v3.7.12` patch	Mar 25, 2026
`v4.2.1` patch	Feb 28, 2026
`v4.2.0` minor	Feb 26, 2026
`v3.7.11` patch	Feb 26, 2026
`v4.1.4` patch	Feb 09, 2026
`v3.7.10` patch	Feb 09, 2026
`v4.1.3` patch	Feb 06, 2026
`v3.7.9` patch	Feb 05, 2026
`v4.1.2` patch	Feb 03, 2026
`v3.7.8` patch	Feb 03, 2026
`v4.1.1` patch	Feb 03, 2026
`v3.7.7` patch	Feb 02, 2026
`v4.1.0` minor	Jan 27, 2026
`v4.0.3` patch	Jan 23, 2026
`v3.7.6` patch	Jan 23, 2026
`v4.0.2` patch	Jan 21, 2026
`v3.7.5` patch	Jan 21, 2026
`v4.0.1` patch	Jan 14, 2026
`v4.0.0` major	Jan 14, 2026
`v3.7.4` patch	Jan 13, 2026
`v4.0.0-beta.6` pre	Jan 08, 2026
`v3.7.3` patch	Dec 19, 2025
`v4.0.0-beta.5` pre	Dec 17, 2025
`v3.7.2` patch	Dec 17, 2025
`v4.0.0-beta.4` pre	Dec 06, 2025
`v3.7.1` patch	Dec 03, 2025
`v4.0.0-beta.3` pre	Nov 12, 2025
`v3.7.0` minor	Nov 12, 2025
`v4.0.0-beta.2` pre	Oct 31, 2025
`v4.0.0-beta.1` pre	Oct 28, 2025
`v3.7.0-beta.2` pre	Oct 21, 2025
`v3.7.0-beta.1` pre	Sep 15, 2025
`v3.6.4` patch	Jul 17, 2025

1–50 of 302

Repository

livewire/livewire

Forks: 1.7k
Open issues: 11
Language: PHP
: 4.6/ 10

Dependencies (8)

Depends on

v4.3.4

illuminate/database ^10.0|^11.0|^12.0|^13.0
illuminate/routing ^10.0|^11.0|^12.0|^13.0
illuminate/support ^10.0|^11.0|^12.0|^13.0
illuminate/validation ^10.0|^11.0|^12.0|^13.0
laravel/prompts ^0.1.24|^0.2|^0.3
league/mime-type-detection ^1.9
symfony/console ^6.0|^7.0|^8.0
symfony/http-kernel ^6.2|^7.0|^8.0

Used by

113

1–10 of 113

Supply-chain exposure

113 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (4)

CVE-2025-54068 GHSA-29cq-5w36-x7w3 Jul 17, 2025

Livewire is vulnerable to remote command execution during component property update hydration

Critical
Network High None None

Impact

In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.

Patches

This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible.

Workarounds

There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.

Resources

No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.

Affected versions

v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.2v3.0.0-beta.3v3.0.0-beta.4v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9

+ 62 more Show less

v3.0.1v3.0.10v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.2.0v3.2.1v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.3.0v3.3.1v3.3.2v3.3.3v3.3.4v3.3.5v3.4.0v3.4.1v3.4.10v3.4.11v3.4.12v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v3.5.0v3.5.1v3.5.10v3.5.11v3.5.12v3.5.13v3.5.14v3.5.15v3.5.16v3.5.17v3.5.18v3.5.19v3.5.2v3.5.20v3.5.3v3.5.4v3.5.5v3.5.6v3.5.7v3.5.8v3.5.9v3.6.0v3.6.1v3.6.2v3.6.3

Fixed in

3.6.4

References

https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
https://nvd.nist.gov/vuln/detail/CVE-2025-54068
https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc
https://github.com/livewire/livewire
https://github.com/livewire/livewire/releases/tag/v3.6.4
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54068

Updated Mar 20, 2026 · Source: OSV.dev
CVE-2024-47823 GHSA-f3cx-396f-7jqp Oct 08, 2024

Livewire Remote Code Execution on File Uploads

High
Network Low Low None

In livewire/livewire prior to v2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., image/png) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack:

Filename is composed of the original file name using $file->getClientOriginalName()

Files stored directly on your server in a public storage disk

Webserver is configured to execute “.php” files

PoC

In the following scenario, an attacker could upload a file called shell.php with an image/png MIME type and execute it on the remote server.

class SomeComponent extends Component { use WithFileUploads; #[Validate('image|extensions:png')] public $file; public function save() { $this->validate(); $this->file->storeAs( path: 'images', name: $this->file->getClientOriginalName(), options: ['disk' => 'public'], ); } }

Affected versions

v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.2v3.0.0-beta.3v3.0.0-beta.4v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9

+ 217 more Show less

v3.0.1v3.0.10v3.0.2v3.0.3v3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.2.0v3.2.1v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.3.0v3.3.1v3.3.2v3.3.3v3.3.4v3.3.5v3.4.0v3.4.1v3.4.10v3.4.11v3.4.12v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8v3.4.9v3.5.0v3.5.1v0.0.1v0.0.10v0.0.11v0.0.12v0.0.13v0.0.14v0.0.15v0.0.2v0.0.3v0.0.4v0.0.5v0.0.6v0.0.7v0.0.8v0.0.9v0.1v0.1.1v0.1.2v0.1.3v0.1.4v0.1.5v0.1.6v0.2.0v0.2.1v0.2.10v0.2.2v0.2.3v0.2.4v0.2.5v0.2.6v0.2.7v0.2.8v0.2.9v0.3.0v0.3.1v0.3.10v0.3.11v0.3.12v0.3.13v0.3.14v0.3.15v0.3.16v0.3.17v0.3.18v0.3.19v0.3.2v0.3.20v0.3.21v0.3.3v0.3.4v0.3.5v0.3.6v0.3.7v0.3.8v0.3.9v0.4.0v0.5.0v0.5.1v0.5.2v0.5.3v0.6.0v0.7.0v0.7.1v0.7.2v0.7.3v0.7.4v1.0.0v1.0.1v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14v1.0.2v1.0.3v1.0.4v1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0v1.3.0v1.3.1v1.3.2v1.3.3v1.3.4v1.3.5v1.3.6v1.3.7v1.3.8v1.3.9v2.0.0v2.0.1v2.0.2v2.0.3v2.0.4v2.1.0v2.1.1v2.1.2v2.1.3v2.1.4v2.10.0v2.10.1v2.10.2v2.10.3v2.10.4v2.10.5v2.10.6v2.10.7v2.10.8v2.11.0v2.11.1v2.11.2v2.11.3v2.12.0v2.12.1v2.12.2v2.12.3v2.12.4v2.12.5v2.12.6v2.2.0v2.2.1v2.2.2v2.2.3v2.2.4v2.2.5v2.2.6v2.2.7v2.2.8v2.2.9v2.3.0v2.3.1v2.3.10v2.3.11v2.3.12v2.3.13v2.3.14v2.3.15v2.3.16v2.3.17v2.3.18v2.3.2v2.3.3v2.3.4v2.3.5v2.3.6v2.3.7v2.3.8v2.3.9v2.4.0v2.4.1v2.4.2v2.4.3v2.4.4v2.5.0v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.7.0v2.7.1v2.7.2v2.8.0v2.8.1v2.8.2v2.9.0

Fixed in

2.12.73.5.2

References

https://github.com/livewire/livewire/security/advisories/GHSA-f3cx-396f-7jqp
https://nvd.nist.gov/vuln/detail/CVE-2024-47823
https://github.com/livewire/livewire/pull/8624
https://github.com/livewire/livewire/commit/70503b79f5db75a1eac9bf55826038a6ee5a16d5
https://github.com/livewire/livewire/commit/cd168c6212ea13d13b82b3132485741f82d9fad9
https://github.com/livewire/livewire

Updated Oct 10, 2024 · Source: OSV.dev
GHSA-qwvp-268g-jjm8 May 15, 2024

Data Leakage Vulnerability in livewire/livewire

Medium

livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The $this->validate() method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.

Affected versions

v2.2.5

Fixed in

2.2.6

References

https://github.com/livewire/livewire/commit/6929f5882138a98187c196ce66cc689712c000af
https://github.com/FriendsOfPHP/security-advisories/blob/master/livewire/livewire/2020-09-22-1.yaml
https://github.com/livewire/livewire
https://github.com/livewire/livewire/releases/tag/v2.2.6

Updated Nov 29, 2024 · Source: OSV.dev
CVE-2024-21504 GHSA-389c-cf87-qmwj Mar 19, 2024

Cross-site Scripting in livewire/livewire

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.

Affected versions

v3.3.5v3.4.0v3.4.1v3.4.2v3.4.3v3.4.4v3.4.5v3.4.6v3.4.7v3.4.8

Fixed in

3.4.9

References

https://nvd.nist.gov/vuln/detail/CVE-2024-21504
https://github.com/livewire/livewire/pull/8117
https://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0
https://github.com/livewire/livewire
https://github.com/livewire/livewire/releases/tag/v3.4.9
https://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222

Updated Mar 20, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 4
minor 33
patch 243
pre 21

302 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More