{"id":"CVE-2026-81887","published":"2026-08-31T20:12:15Z","modified":"2026-09-03T18:03:10Z","title":"Livewire DOM-based cross-site scripting during client-side state handling","vendor":"livewire","product":"livewire","tier":"tail","description":{"text":"Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers then access effects.html, effects.js, effects.xjs, and effects.scripts without Object.prototype.hasOwnProperty.call(), allowing inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Exploitation requires user interaction and does not bypass server-side authorization or grant privileges beyond the affected user. This issue is fixed in versions 3.8.3 and 4.3.4.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.1,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00682,"percentile":0.52337,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"},{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"references":[{"url":"https://github.com/livewire/livewire/security/advisories/GHSA-g3hc-697w-wm82","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/livewire/livewire/pull/10467","tags":["x_refsource_MISC"]},{"url":"https://github.com/livewire/livewire/commit/11ebe646f7e81dde2d714815da8b3019d058561e","tags":["x_refsource_MISC"]},{"url":"https://github.com/livewire/livewire/releases/tag/v3.8.3","tags":["x_refsource_MISC"]},{"url":"https://github.com/livewire/livewire/releases/tag/v4.3.4","tags":["x_refsource_MISC"]}],"priority":{"score":14.0,"factors":[{"name":"EPSS percentile","points":10.47},{"name":"CVSS severity","points":3.57}]},"vendorSlug":"livewire","affectedVersions":[{"vendor":"livewire","product":"livewire","versions":[">= 3.0.0-beta.1, < 3.8.3",">= 4.0.0-beta.1, < 4.3.4"]}],"affected":[{"ecosystem":"Packagist","package":"livewire/livewire","vulnerableRanges":[">=3.0.0-beta.1, <3.8.3",">=4.0.0-beta.1, <4.3.4"],"patched":["3.8.3","4.3.4"],"from":["GHSA-g3hc-697w-wm82"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-68765","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-21504","published":"2024-03-19","fixed":"3.4.9","kev":false},{"cve":"CVE-2024-47823","published":"2024-10-08","fixed":"3.5.2","kev":false},{"cve":"CVE-2025-54068","published":"2025-07-17","fixed":"3.6.4","kev":true,"link":{"from":"CVE-2025-54068","to":"CVE-2026-81887","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:livewire/livewire","fromFixed":"3.6.4","toFixed":"3.8.3","daysApart":410}]}},{"cve":"CVE-2026-81887","published":"2026-08-31","fixed":"4.3.4","kev":false}],"package":"Packagist:livewire/livewire"}}