Livewire’s dot‑notated query‑string parser in js/plugins/history/index.js has a flaw that allows attacker‑controlled path segments such as __proto__, constructor, and prototype to create inherited properties. When client‑side state handlers, which access effect.* properties, read these properties without verifying ownership, the prototype chain can inject malicious JavaScript code. An unauthenticated attacker can craft a URL that, when a user visits it, causes the browser to execute arbitrary JavaScript in the context of the affected application. This attack affects confidentiality, integrity, and availability by allowing the attacker to run scripts that can steal session data or manipulate the page.

Any Laravel application using the Livewire framework below version 3.8.3 or 4.3.4 is vulnerable. The affected packages include Livewire 3.x from 3.0.0‑beta.1 up to 3.8.2 and Livewire 4.x from 4.0.0 up to 4.3.3. Those editions expose the vulnerable history module; applications that have upgraded to v3.8.3 or v4.3.4 contain the fix.

The CVSS score of 5.1 indicates a moderate risk, and the EPSS score is not available. The vulnerability is not in the KEV catalog. Exploitation requires that the user opens a crafted URL, so it is user‑dependent, but once achieved an attacker gains the same privileges as the user and can execute arbitrary JavaScript within the site’s origin. The best mitigation is to install the patched Livewire release promptly, and, while updating, consider additional defenses such as input sanitization and a strong Content‑Security‑Policy.