cnvd-2026-43184

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-54068",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-54068"
    }
  },
  "description": "Laravel Livewire是Laravel的一个全栈框架，让你用纯PHP就能构建动态、响应式的前端界面，无需写JavaScript代码。\n\nLaravel Livewire存在代码注入漏洞，该漏洞源于组件属性更新处理不当，攻击者可利用该漏洞导致远程命令执行。",
  "formalWay": "目前厂商已发布升级程序修复该安全问题，详情见厂商官网:\r\nhttps://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc\r\nhttps://github.com/livewire/livewire/releases/tag/v3.6.4\r\nhttps://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3\r\nhttps://github.com/livewire/livewire/releases",
  "isEvent": "通用软硬件漏洞",
  "number": "CNVD-2026-43184",
  "openTime": "2026-10-30",
  "patchDescription": "Laravel Livewire是Laravel的一个全栈框架，让你用纯PHP就能构建动态、响应式的前端界面，无需写JavaScript代码。\r\n\r\nLaravel Livewire存在代码注入漏洞，该漏洞源于组件属性更新处理不当，攻击者可利用该漏洞导致远程命令执行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。",
  "patchName": "Laravel Livewire代码注入漏洞的补丁",
  "products": {
    "product": "Laravel Livewire >=3.0.0-beta.1, <3.6.4"
  },
  "referenceLink": "https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc",
  "serverity": "高",
  "submitTime": "2025-07-25",
  "title": "Laravel Livewire代码注入漏洞"
}