CVE-2026-81887: Livewire DOM-based cross-site scripting in client-side state handling

CVE-2026-81887 · Severity: medium · CVSS 4 · Published 2026-08-31

Livewire is a PHP framework that enables reactive, dynamic web components. A DOM-based cross-site scripting (XSS) vulnerability in Livewire v3 and v4 allows attackers to inject and execute arbitrary JavaScript code in a user's browser within the context of an affected application. While the attack requires user interaction (such as clicking a malicious link), it does not require authentication or prior account access, and could enable session hijacking, data theft, or malware distribution.

Technologies: livewire/livewire (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-81887 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81887 being exploited in the wild.
How severe is CVE-2026-81887?
Medium severity, with a CVSS score of 4, published 31 August 2026.
Which products and versions are affected?
livewire/livewire (Packagist) ECOSYSTEM:introduced=3.0.0-beta.1,fixed=3.8.3.
Is there a fix for CVE-2026-81887?
Yes. livewire/livewire (Packagist): upgrade to 3.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81887 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-81887?
Check whether you run livewire/livewire (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • livewire/livewire (Packagist): upgrade to 3.8.3 or later
    composer require livewire/livewire:^3.8.3

Technical details

This vulnerability is a DOM-based cross-site scripting (CWE-79) issue that also involves prototype pollution (CWE-1321) in how Livewire handles client-side component state. The root cause lies in improper neutralization of user input during client-side DOM manipulation, allowing attackers to inject malicious JavaScript through specific component state parameters. Exploitation requires user interaction (Active UI requirement), but no authentication or prior access to the application. The attack vector is network-based with low complexity; an attacker can craft a malicious URL or payload and trick a user into interacting with it. Successful exploitation grants the attacker only the privileges that the victim user holds and does not bypass server-side authorization. Patches are available in Livewire v3.8.3 and v4.3.4; users should upgrade immediately as no workarounds are documented.

Affected products

  • Livewire Livewire 3.0.0-beta.1 through 3.8.2, 4.0.0-beta.1 through 4.3.3

Identifiers

  • CVE-2026-81887
  • GHSA-g3hc-697w-wm82

Timeline

  • 2026-08-10: disclosed: Vulnerability initially published by GitHub on August 10, 2026
  • 2026-08-10: patched: Patches released in Livewire v3.8.3 and v4.3.4
  • 2026-09-02: advisory: GitHub Advisory GHSA-g3hc-697w-wm82 published; CVE-2026-81887 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.