Is CVE-2025-54068 exploited in the wild?

Yes. CVE-2025-54068 is known to be exploited in the wild, first recorded on 20 March 2026. Treat it as urgent.

How severe is CVE-2025-54068?

Critical severity, with a CVSS score of 3.1, published 17 July 2025.

Which products and versions are affected?

Laravel Livewire v3.0.0 to v3.6.3; livewire/livewire (Packagist) ECOSYSTEM:introduced=3.0.0-beta.1,fixed=3.6.4.

Is there a fix for CVE-2025-54068?

Yes. livewire/livewire (Packagist): upgrade to 3.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-54068 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-54068?

Check whether you run Laravel Livewire or livewire/livewire (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54068: Livewire is vulnerable to remote command execution during component property update hydration

CVE-2025-54068 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2025-07-17

Laravel Livewire, a popular framework for building interactive web interfaces, contains a critical security flaw that allows attackers to execute unauthorized commands on the server. This vulnerability can be exploited over the internet without needing a username or password, potentially leading to a full system takeover or data breach. Organizations using Livewire version 3 should update to version 3.6.4 immediately to protect their operations and customer data.

Technologies: Laravel Livewire, livewire/livewire (Packagist). Vendors: Laravel, Packagist.

Quick answers

Is CVE-2025-54068 exploited in the wild?: Yes. CVE-2025-54068 is known to be exploited in the wild, first recorded on 20 March 2026. Treat it as urgent.
How severe is CVE-2025-54068?: Critical severity, with a CVSS score of 3.1, published 17 July 2025.
Which products and versions are affected?: Laravel Livewire v3.0.0 to v3.6.3; livewire/livewire (Packagist) ECOSYSTEM:introduced=3.0.0-beta.1,fixed=3.6.4.
Is there a fix for CVE-2025-54068?: Yes. livewire/livewire (Packagist): upgrade to 3.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54068 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-54068?: Check whether you run Laravel Livewire or livewire/livewire (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

livewire/livewire (Packagist): upgrade to 3.6.4 or later
```
composer require livewire/livewire:^3.6.4
```

Technical details

A code injection vulnerability (CWE-94) exists in Laravel Livewire v3 due to the improper hydration of certain component property updates. An unauthenticated remote attacker can exploit this by sending specially crafted requests to a server where a Livewire component is mounted and configured in a specific manner. Successful exploitation allows for arbitrary remote code execution (RCE) on the underlying host. This issue is specific to Livewire v3 and does not affect earlier major versions. The vulnerability has been observed being exploited in the wild by threat actors. A fix is available in version 3.6.4.

Affected products

Laravel Livewire v3.0.0 to v3.6.3

Identifiers

CVE-2025-54068
GHSA-29cq-5w36-x7w3

Timeline

2025-07-17: disclosed: Initial NVD publication and vendor advisory
2025-07-17: patched: Fixed in version 3.6.4
2026-03-20: kev added: Added to CISA Known Exploited Vulnerabilities catalog
2026-03-20: exploited: Confirmed exploitation in the wild by threat actors

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.