CVE-2026-81887: Livewire XSS Vulnerability

CVE-2026-81887 Overview

CVE-2026-81887 is a client-side prototype pollution vulnerability in Livewire, a full-stack framework for Laravel. The flaw resides in the dot-notated query-string parser located in js/plugins/history/index.js. The fromQueryString() and insertDotNotatedValueIntoData() functions accept __proto__, constructor, and prototype path segments, creating inherited objects. Client-side state handlers then read effects.html, effects.js, effects.xjs, and effects.scripts without calling Object.prototype.hasOwnProperty.call(), treating attacker-controlled inherited state as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Affected versions span 3.0.0-beta.1 through releases prior to 3.8.3 and 4.3.4.

Critical Impact
A crafted URL opened by a victim executes attacker-controlled JavaScript within the Livewire application's origin, enabling session theft, request forgery, and DOM manipulation.

Affected Products

Livewire 3.0.0-beta.1 through versions prior to 3.8.3
Livewire 4.x versions prior to 4.3.4
Laravel applications embedding vulnerable Livewire client-side assets

Discovery Timeline

2026-08-31 - CVE-2026-81887 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-81887

Vulnerability Analysis

The vulnerability is a Cross-Site Scripting (XSS) issue rooted in client-side prototype pollution [CWE-79]. Livewire tracks component state through URL query parameters using dot notation, letting the client rehydrate nested objects from ?foo.bar=baz-style parameters. The parser walks each dot segment and assigns values without filtering dangerous keys.

When an attacker supplies a segment such as __proto__.html, the parser writes onto Object.prototype. Every subsequent object literal inherits that value. Livewire's effect pipeline reads effects.html, effects.js, effects.xjs, and effects.scripts with plain property access. Because inherited properties are indistinguishable from own properties without hasOwnProperty checks, the framework processes the polluted value as a legitimate effect and injects it into the DOM or evaluates it as JavaScript.

Root Cause

The insertDotNotatedValueIntoData() helper in js/plugins/history/index.js did not deny-list the __proto__, constructor, and prototype path segments. Downstream consumers in js/component.js and js/features/supportDispatches.js used bare property lookups on effect objects, so inherited attacker data was treated as trusted framework output.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker constructs a URL that pollutes Object.prototype through the query string. When a victim visits the link, Livewire's history plugin parses the parameters, contaminates the prototype chain, and the client-side runtime evaluates the injected effects.html or effects.scripts payload in the application's origin. Server-side authorization is not bypassed, and privileges do not exceed those of the affected user.

javascript

// Security patch in js/component.js — PR #10467
el.setAttribute('wire:snapshot', this.snapshotEncoded)

let effects = {}

// We need to re-register any event listeners that were originally registered...
if (Object.prototype.hasOwnProperty.call(this.originalEffects, 'listeners') && this.originalEffects.listeners) {
    effects.listeners = this.originalEffects.listeners
}

// We need to re-register any url/query-string bindings...
if (Object.prototype.hasOwnProperty.call(this.originalEffects, 'url') && this.originalEffects.url) {
    effects.url = this.originalEffects.url
}

// We need to re-register any scripts that were originally registered...
if (Object.prototype.hasOwnProperty.call(this.originalEffects, 'scripts') && this.originalEffects.scripts) {
    effects.scripts = this.originalEffects.scripts
}

Source: Livewire commit 11ebe64. The patch wraps every effect lookup in Object.prototype.hasOwnProperty.call() to reject inherited properties.

Detection Methods for CVE-2026-81887

Indicators of Compromise

Inbound HTTP requests whose query strings contain the tokens __proto__, constructor, or prototype as dot-notated segments.
Referer headers or access logs showing URLs with encoded variants such as %5F%5Fproto%5F%5F targeting Livewire routes.
Unexpected <script> execution or DOM mutations in browser telemetry originating from Livewire component rehydration.

Detection Strategies

Deploy web application firewall (WAF) rules that block query parameters containing __proto__, constructor.prototype, or prototype. path segments.
Inventory deployed Livewire versions by inspecting composer.lock and the published JavaScript bundle for versions below 3.8.3 or 4.3.4.
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages that host Livewire components.

Monitoring Recommendations

Forward web server access logs and CSP reports into a centralized analytics platform and alert on prototype-pollution keywords in URL parameters.
Correlate outbound requests from user browsers with recent Livewire page visits to identify credential exfiltration attempts.
Track authentication anomalies such as session reuse from new geolocations following user clicks on external links.

How to Mitigate CVE-2026-81887

Immediate Actions Required

Upgrade Livewire to version 3.8.3 for the 3.x branch or 4.3.4 for the 4.x branch without delay.
Purge cached copies of the vulnerable livewire.js bundle from CDNs, browsers, and reverse proxies after upgrading.
Rotate session cookies and API tokens for any users who may have clicked untrusted links during the exposure window.

Patch Information

Fix commit 11ebe64 landed via pull request #10467. Patched artifacts are published in Livewire v3.8.3 and Livewire v4.3.4. See the GHSA-g3hc-697w-wm82 advisory for the coordinated disclosure record.

Workarounds

Enforce a strict Content Security Policy that forbids inline scripts and unsafe evaluations to blunt XSS impact.
Add a WAF or middleware filter that rejects requests where query keys contain __proto__, constructor, or prototype segments.
Instruct users to avoid clicking untrusted Livewire application links until the patch is deployed.

bash

# Upgrade Livewire via Composer to a patched release
composer require livewire/livewire:^3.8.3
# or, for the 4.x branch
composer require livewire/livewire:^4.3.4

# Verify the installed version
php artisan about | grep -i livewire