CVE-2026-81887

Name of the Vulnerable Software and Affected Versions Livewire versions 3.0.0-beta.1 through 3.8.2 Livewire versions 4.0.0 through 4.3.3

Description The dot-notated query-string parser in js/plugins/history/index.js, specifically within the fromQueryString() and insertDotNotatedValueIntoData() functions, fails to properly handle proto, constructor, and prototype path segments, leading to the creation of inherited objects. Client-side state handlers subsequently access effects.html, effects.js, effects.xjs, and effects.scripts without using Object.prototype.hasOwnProperty.call(), which allows inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the application's origin. This exploitation requires user interaction and does not bypass server-side authorization or grant elevated privileges.

Recommendations Update to version 3.8.3. Update to version 4.3.4.