Data Leakage Vulnerability in livewire/livewire
livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The $this->validate() method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | livewire/livewire | >= 2.2.5, < 2.2.6 | 2.2.6 |
References
- Weakness (CWE)
CWE-200- Platform
- Composer
- Package
livewire/livewire- Disclosed
- 15.05.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-qwvp-268g-jjm8 - CC BY 4.0
Vulnerability history: livewire/livewire
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 03.2024 09.2026
- Without a fix
- 0
- Exploited in attacks
- 1
Severity breakdown
- Critical 1
- High 1
- Medium 3
Disclosures per year
- 2024: 3
- 2025: 1
- 2026: 1
-
Data Leakage Vulnerability in livewire/livewire this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.