As reported in CVE-2025-54068, anyone running Livewire before 3.6.3 is vulnerable to remote command execution during component property update hydration. Here is how it's explained in the CVE:
In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.
According to Securing Laravel, "it's a rather sneaky vulnerability that can be disastrously effective".
This issue has been patched in Livewire v3.6.4, and you should update to this version as soon as possible.
To update, run the following to get the latest version:
composer update livewire/livewire
Then, ensure it's 3.6.4 or higher with the show command:
composer show livewire/livewire
