CVE-2025-54068: Livewire Hydrate For Update Recursive Tuple Hydrate
Livewire HandleComponents calls the generic recursive `hydrate([$value, $meta], ...)` with attacker-supplied `$value` and snapshot meta during property-update hydration. Because `hydrate()` recurses into nested children without re-anchoring to the checksum-validated snapshot (`$raw`), an attacker can embed a synthetic-tuple `[payload, ['s' => '<key>', 'class
PHPgreprules fetch cve-2025-54068-livewire-hydrate-for-update-recursive-tuple-hydrate --engine opengrepDescription
Livewire HandleComponents calls the generic recursive `hydrate([$value, $meta], ...)` with attacker-supplied `$value` and snapshot meta during property-update hydration. Because `hydrate()` recurses into nested children without re-anchoring to the checksum-validated snapshot (`$raw`), an attacker can embed a synthetic-tuple `[payload, ['s' => '<key>', 'class
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.