Data Leakage Vulnerability in livewire/livewire
Summary
GHSA-qwvp-268g-jjm8: Data Leakage Vulnerability in livewire/livewire. Affects livewire/livewire versions >= 2.2.5, < 2.2.6. Fixed in 2.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
livewire/livewire is a package available on Packagist that provides a seamless way to build dynamic interfaces in Laravel applications. It allows developers to create interactive UI components using PHP and Blade syntax. The package is widely used in Laravel projects to enhance user experience and simplify frontend development. However, versions greater than 2.2.4 and less than 2.2.6 of livewire/livewire are affected by a data leakage vulnerability.
Vulnerability Detail
The vulnerability in livewire/livewire arises from a regression in the $this->validate() method. Instead of returning only the validated dataset, this method was returning all properties of the Livewire component. This flaw introduces a security risk as unvalidated data can be exposed, potentially leading to unexpected behavior and security issues. An attacker could exploit this vulnerability to access sensitive information or manipulate the application's state.
How To Fix
Minimum fixed version
2.2.6
This is the first release that contains the fix.
composer require livewire/livewire:2.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the fix by upgrading to the patched version of livewire/livewire.
Conclusion
livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. It is crucial for developers to upgrade to version 2.2.6 or higher to mitigate this risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for livewire/livewire →
FAQ
livewire/livewire is a package that allows developers to build dynamic interfaces in Laravel applications using PHP and Blade syntax.
Versions greater than 2.2.4 and less than 2.2.6 of livewire/livewire are affected by this vulnerability.
This vulnerability can lead to data leakage, unexpected behavior, and potential security issues in applications using livewire/livewire.
To fix this vulnerability, upgrade livewire/livewire to version 2.2.6 or higher.
No, there is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for livewire/livewire.
