JavaScript Injection Vulnerability in Livewire Framework by Laravel
CVE-2026-81887
5.1MEDIUM
What is CVE-2026-81887?
The Livewire framework for Laravel contains a vulnerability in its dot-notated query-string parser. This flaw allows an unauthenticated attacker to manipulate the state by crafting a malicious URL, leading to arbitrary JavaScript execution within the context of the affected application. Important security details, like Object.prototype.hasOwnProperty.call, are not utilized, enabling inherited properties to be trusted, which makes client-side security at risk. It is crucial to upgrade to the fixed versions 3.8.3 and 4.3.4 to mitigate this issue.
Affected Version(s)
livewire >= 3.0.0-beta.1, < 3.8.3 < 3.0.0-beta.1, 3.8.3
livewire >= 4.0.0-beta.1, < 4.3.4 < 4.0.0-beta.1, 4.3.4