CVE-2025-54068: Laravel Livewire Code Injection Vulnerability

Laravel Livewire contains a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. The issue affects applications built with this PHP component and can result in unauthorized control of the underlying server when the vulnerable code path is reached.

How it works

CWE-94 describes improper control of code generation, allowing an attacker to supply input that is later interpreted as executable code. In this case an unauthenticated request can reach a code path where attacker-controlled data influences dynamic code creation or evaluation. The result is remote command execution without prior authentication when the application processes the request in the affected configuration.

Am I affected? How to find it in your systems

Inventory all web applications that include the Laravel Livewire package. Locate instances by examining composer.json files, deployed vendor directories, or container images for references to the Livewire component. Review application routes and Livewire component classes that accept untrusted input and perform any form of dynamic code handling. Specific version numbers and configuration triggers must be confirmed against the vendor advisory. Monitor web server and application logs for unexpected command execution patterns or error messages tied to Livewire request handling.

How to remediate

Apply the vendor update named in the advisory as the primary action. After patching, review Livewire component code to ensure that user-supplied data is never passed into functions that generate or evaluate code. Restrict the exposure of Livewire endpoints to authenticated sessions where possible and validate all inputs against strict allow-lists before any processing occurs.

If you can't patch immediately

• Apply mitigations per the vendor instructions.
• Follow applicable BOD 22-01 guidance for any cloud-hosted instances.
• Discontinue use of the product if mitigations are unavailable.
• Place affected applications behind network segmentation that limits inbound access to trusted sources only.
• Enable enhanced logging of Livewire requests and set up alerts for anomalous command-line activity on the host.

If your data may have been exposed

Actively exploited vulnerabilities of this class have led to breaches in other products. Organizations can run a free exposure scan of their email domains to check known breach data and determine whether related credentials or data have already appeared in public records.