Executive brief
Livewire is a PHP framework that enables reactive, dynamic web components. A DOM-based cross-site scripting (XSS) vulnerability in Livewire v3 and v4 allows attackers to inject and execute arbitrary JavaScript code in a user's browser within the context of an affected application. While the attack requires user interaction (such as clicking a malicious link), it does not require authentication or prior account access, and could enable session hijacking, data theft, or malware distribution.
Technical details
This vulnerability is a DOM-based cross-site scripting (CWE-79) issue that also involves prototype pollution (CWE-1321) in how Livewire handles client-side component state. The root cause lies in improper neutralization of user input during client-side DOM manipulation, allowing attackers to inject malicious JavaScript through specific component state parameters. Exploitation requires user interaction (Active UI requirement), but no authentication or prior access to the application. The attack vector is network-based with low complexity; an attacker can craft a malicious URL or payload and trick a user into interacting with it. Successful exploitation grants the attacker only the privileges that the victim user holds and does not bypass server-side authorization. Patches are available in Livewire v3.8.3 and v4.3.4; users should upgrade immediately as no workarounds are documented.
Affected products
- Livewire Livewire 3.0.0-beta.1 through 3.8.2, 4.0.0-beta.1 through 4.3.3
Timeline
- 2026-08-10: disclosed: Vulnerability initially published by GitHub on August 10, 2026
- 2026-08-10: patched: Patches released in Livewire v3.8.3 and v4.3.4
- 2026-09-02: advisory: GitHub Advisory GHSA-g3hc-697w-wm82 published; CVE-2026-81887 assigned