Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers then access effects.html, effects.js, effects.xjs, and effects.scripts without Object.prototype.hasOwnProperty.call(), allowing inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Exploitation requires user interaction and does not bypass server-side authorization or grant privileges beyond the affected user. This issue is fixed in versions 3.8.3 and 4.3.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🟠 Livewire, DOM-based Cross-Site Scripting (XSS), #CVE-2026-81887 (Moderate) -DC-Sep2026-2094 https://dailycve.com/livewire-dom-based-cross-site-scripting-xss-cve-2026-81887-moderate-dc-sep2026-2094/
Post summary
The post announces a new DOM‑based XSS vulnerability, CVE‑2026‑81887, as a moderate risk, but provides no Proof‑of‑Concept, exploit code, active‑exploitation evidence, or remediation guidance.
El CI de uno de nuestros proyectos se ha ganado el sueldo xD Ha parado el merge de una feature por la vulnerabilidad de livewire/livewire CVE-2026-81887 (DOM-based XSS) Da gusto
Post summary
The message indicates that a CI pipeline halted a feature merge due to the discovery of CVE-2026-81887, a DOM-based XSS vulnerability in Livewire.