CVE-2026-81887

Received Received - Intake

Prototype Pollution in Livewire JavaScript History Plugin

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers then access effects.html, effects.js, effects.xjs, and effects.scripts without Object.prototype.hasOwnProperty.call(), allowing inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Exploitation requires user interaction and does not bypass server-side authorization or grant privileges beyond the affected user. This issue is fixed in versions 3.8.3 and 4.3.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-81887

Affected Vendors & Products

Vendor	Product	Version / Range
livewire	livewire	to 3.8.3 (inc)
livewire	livewire	4.3.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Livewire versions 3.0.0-beta.1 to 3.8.3 and 4.3.4 have a flaw in the query-string parser that allows attacker-controlled input via special path segments like __proto__, constructor, and prototype. This can create inherited objects that bypass security checks. When user-opened URLs are processed, arbitrary JavaScript may execute in the application's origin due to unsafe access to effects-related properties.

Detection Guidance

This vulnerability involves client-side state manipulation via crafted URLs. To detect it, inspect network traffic for URLs containing __proto__, constructor, or prototype in query parameters. Check if your Livewire application versions are between 3.0.0-beta.1 and 3.8.3 or 4.3.4.

Impact Analysis

An unauthenticated attacker could trick a user into opening a malicious URL, leading to arbitrary JavaScript execution within the affected application. This requires user interaction and does not bypass server-side authorization or grant elevated privileges beyond the user's access level.

Compliance Impact

This vulnerability allows arbitrary JavaScript execution in the affected application's origin through crafted URLs. This could lead to unauthorized data access, modification, or exfiltration, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade Livewire to version 3.8.3 or 4.3.4 or later to fix the vulnerability. Review and remove any user-controlled input from query strings that could exploit the dot-notated parser. Monitor network traffic for suspicious URLs containing __proto__, constructor, or prototype segments.

Hi! I’m here to help you understand CVE-2026-81887. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70