GHSA-G3HC-697W-WM82

Vulnerability from github – Published: 2026-09-02 14:38 – Updated: 2026-09-02 14:38
VLAI
Summary
Livewire DOM-based cross-site scripting during client-side state handling
Details

Impact

In Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.

Patches

This issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.

Workarounds

There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.

Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.8.2"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "livewire/livewire"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-beta.1"
            },
            {
              "fixed": "3.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.3.3"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "livewire/livewire"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-beta.1"
            },
            {
              "fixed": "4.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-81887"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T14:38:58Z",
    "nvd_published_at": "2026-08-31T21:17:52Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIn Livewire v3 (\u2264 3.8.2) and v4 (\u2264 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.\n\n### Patches\nThis issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.\n\n### Workarounds\nThere is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.",
  "id": "GHSA-g3hc-697w-wm82",
  "modified": "2026-09-02T14:38:58Z",
  "published": "2026-09-02T14:38:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/livewire/livewire/security/advisories/GHSA-g3hc-697w-wm82"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81887"
    },
    {
      "type": "WEB",
      "url": "https://github.com/livewire/livewire/pull/10467"
    },
    {
      "type": "WEB",
      "url": "https://github.com/livewire/livewire/commit/11ebe646f7e81dde2d714815da8b3019d058561e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/livewire/livewire"
    },
    {
      "type": "WEB",
      "url": "https://github.com/livewire/livewire/releases/tag/v3.8.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/livewire/livewire/releases/tag/v4.3.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Livewire DOM-based cross-site scripting during client-side state handling"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.