Cross-site Scripting in livewire/livewire
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.
As published by the sources
Affected packages
- Affected
>=3.3.5,<3.4.9Fixed in3.4.9
Derived from the fixed versions above
What to do
Upgrade livewire/livewire to 3.4.9 or later.
composer update livewire/livewire --with-dependencies
To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.
Quoted from the original advisory
Details
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.
References
- Advisoryhttps://github.com/advisories/GHSA-389c-cf87-qmwj
- Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2024-21504
- Webhttps://github.com/livewire/livewire/pull/8117
- Webhttps://github.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0
- Packagehttps://github.com/livewire/livewire
- Webhttps://github.com/livewire/livewire/releases/tag/v3.4.9
- Webhttps://security.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222