# CVE-2026-81887: Livewire DOM-based cross-site scripting in client-side state handling

Source: https://junglewise.ai/threats/cve-2026-81887-livewire-dom-based-cross-site-scripting-in-client-side-state  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81887 · Severity: medium · CVSS 4 · Published 2026-08-31

Livewire is a PHP framework that enables reactive, dynamic web components. A DOM-based cross-site scripting (XSS) vulnerability in Livewire v3 and v4 allows attackers to inject and execute arbitrary JavaScript code in a user's browser within the context of an affected application. While the attack requires user interaction (such as clicking a malicious link), it does not require authentication or prior account access, and could enable session hijacking, data theft, or malware distribution.

Technologies: [livewire/livewire (Packagist)](https://junglewise.ai/threats/technologies/livewire-livewire). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-81887 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81887 being exploited in the wild.

**How severe is CVE-2026-81887?** Medium severity, with a CVSS score of 4, published 31 August 2026.

**Which products and versions are affected?** livewire/livewire (Packagist) ECOSYSTEM:introduced=3.0.0-beta.1,fixed=3.8.3.

**Is there a fix for CVE-2026-81887?** Yes. livewire/livewire (Packagist): upgrade to 3.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81887 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81887?** Check whether you run livewire/livewire (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- livewire/livewire (Packagist): upgrade to 3.8.3 or later

  ```sh
  composer require livewire/livewire:^3.8.3
  ```


## Technical details

This vulnerability is a DOM-based cross-site scripting (CWE-79) issue that also involves prototype pollution (CWE-1321) in how Livewire handles client-side component state. The root cause lies in improper neutralization of user input during client-side DOM manipulation, allowing attackers to inject malicious JavaScript through specific component state parameters. Exploitation requires user interaction (Active UI requirement), but no authentication or prior access to the application. The attack vector is network-based with low complexity; an attacker can craft a malicious URL or payload and trick a user into interacting with it. Successful exploitation grants the attacker only the privileges that the victim user holds and does not bypass server-side authorization. Patches are available in Livewire v3.8.3 and v4.3.4; users should upgrade immediately as no workarounds are documented.

## Affected products

- Livewire Livewire 3.0.0-beta.1 through 3.8.2, 4.0.0-beta.1 through 4.3.3

## Identifiers

- CVE-2026-81887
- GHSA-g3hc-697w-wm82

## Timeline

- 2026-08-10: disclosed: Vulnerability initially published by GitHub on August 10, 2026
- 2026-08-10: patched: Patches released in Livewire v3.8.3 and v4.3.4
- 2026-09-02: advisory: GitHub Advisory GHSA-g3hc-697w-wm82 published; CVE-2026-81887 assigned

## References

- [https://api.github.com/users/Vagebondcur](https://api.github.com/users/Vagebondcur)
- [https://github.com/Vagebondcur](https://github.com/Vagebondcur)
- [https://api.github.com/users/Vagebondcur/gists%7B/gist_id%7D](https://api.github.com/users/Vagebondcur/gists%7B/gist_id%7D)
- [https://api.github.com/users/Vagebondcur/repos](https://api.github.com/users/Vagebondcur/repos)
- [https://avatars.githubusercontent.com/u/103751916?v=4](https://avatars.githubusercontent.com/u/103751916?v=4)
- [https://api.github.com/users/Vagebondcur/events%7B/privacy%7D](https://api.github.com/users/Vagebondcur/events%7B/privacy%7D)

## Related threats

- [Laravel Livewire authorization bypass via reordered parameters and #[Json] execution order](https://junglewise.ai/threats/livewire-authorization-bypass-in-authorize-via-reordered-parameter-keys-033fc9d0)
- [Livewire is vulnerable to remote command execution during component property update hydration](https://junglewise.ai/threats/cve-2025-54068-laravel-livewire-code-injection-in-component-hydration)
- [Livewire Remote Code Execution on File Uploads](https://junglewise.ai/threats/cve-2024-47823-livewire-remote-code-execution-on-file-uploads)
- [Data Leakage Vulnerability in livewire/livewire](https://junglewise.ai/threats/data-leakage-vulnerability-in-livewire-livewire-b4e3a064)
- [Cross-site Scripting in livewire/livewire](https://junglewise.ai/threats/cve-2024-21504-cross-site-scripting-in-livewire-livewire)