{"items":[{"id":"NVI-00008304","kind":"vulnerability","title":"Livewire DOM-based cross-site scripting during client-side state handling","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g3hc-697w-wm82","CVE-2026-81887"],"plain_summary":"OSV carries this publisher advisory for livewire/livewire, livewire/livewire. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.8.3 for livewire/livewire. Confirm the publisher’s latest guidance.","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.3.4 for livewire/livewire. Confirm the publisher’s latest guidance.","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-36bed99b3a2a57ca445533123a8f8908"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.682%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.5248. Missing scores are unknown.","source_id":"sr-36bed99b3a2a57ca445533123a8f8908"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-fe0cf4a681121bca100a7439aa1f3ebc","url":"https://github.com/advisories/GHSA-g3hc-697w-wm82","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-g3hc-697w-wm82","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.410Z"},{"id":"sr-36bed99b3a2a57ca445533123a8f8908","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-81887","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.287Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"technology":"livewire/livewire","known_exclusions":[],"conditions_summary":"### Impact\nIn Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.\n\n### Patches\nThis issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.\n\n### Workarounds\nThere is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.","public_affected_ranges":["ECOSYSTEM: introduced 3.0.0-beta.1; fixed 3.8.3"]},{"certainty":"source_listed","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"technology":"livewire/livewire","known_exclusions":[],"conditions_summary":"### Impact\nIn Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.\n\n### Patches\nThis issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.\n\n### Workarounds\nThere is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0-beta.1; fixed 4.3.4"]}],"null_published_at":"2026-11-07T18:43:15.100Z","source_updated_at":"2026-09-02T14:45:06.133Z","source_disclosed_at":"2026-09-02T14:38:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:20.410Z"},{"id":"NVI-00008304","kind":"vulnerability","title":"Livewire DOM-based cross-site scripting during client-side state handling","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g3hc-697w-wm82","CVE-2026-81887"],"plain_summary":"OSV carries this publisher advisory for livewire/livewire, livewire/livewire. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.8.3 for livewire/livewire. Confirm the publisher’s latest guidance.","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.3.4 for livewire/livewire. Confirm the publisher’s latest guidance.","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-8309c7732594de10a6dcfbe23d3ae9e6"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.682%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.52488. Missing scores are unknown.","source_id":"sr-8309c7732594de10a6dcfbe23d3ae9e6"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-fe0cf4a681121bca100a7439aa1f3ebc","url":"https://github.com/advisories/GHSA-g3hc-697w-wm82","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-g3hc-697w-wm82","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.410Z"},{"id":"sr-8309c7732594de10a6dcfbe23d3ae9e6","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-81887","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.385Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"technology":"livewire/livewire","known_exclusions":[],"conditions_summary":"### Impact\nIn Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.\n\n### Patches\nThis issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.\n\n### Workarounds\nThere is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.","public_affected_ranges":["ECOSYSTEM: introduced 3.0.0-beta.1; fixed 3.8.3"]},{"certainty":"source_listed","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"technology":"livewire/livewire","known_exclusions":[],"conditions_summary":"### Impact\nIn Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.\n\n### Patches\nThis issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.\n\n### Workarounds\nThere is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0-beta.1; fixed 4.3.4"]}],"null_published_at":"2026-11-03T02:33:09.092Z","source_updated_at":"2026-09-02T14:45:06.133Z","source_disclosed_at":"2026-09-02T14:38:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:20.410Z"},{"id":"NVI-00008304","kind":"vulnerability","title":"Livewire DOM-based cross-site scripting during client-side state handling","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g3hc-697w-wm82","CVE-2026-81887"],"plain_summary":"OSV carries this publisher advisory for livewire/livewire, livewire/livewire. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.8.3 for livewire/livewire. Confirm the publisher’s latest guidance.","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.3.4 for livewire/livewire. Confirm the publisher’s latest guidance.","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-fe0cf4a681121bca100a7439aa1f3ebc","url":"https://github.com/advisories/GHSA-g3hc-697w-wm82","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-g3hc-697w-wm82","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:20.410Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"technology":"livewire/livewire","known_exclusions":[],"conditions_summary":"### Impact\nIn Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.\n\n### Patches\nThis issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.\n\n### Workarounds\nThere is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.","public_affected_ranges":["ECOSYSTEM: introduced 3.0.0-beta.1; fixed 3.8.3"]},{"certainty":"source_listed","source_ids":["sr-fe0cf4a681121bca100a7439aa1f3ebc"],"technology":"livewire/livewire","known_exclusions":[],"conditions_summary":"### Impact\nIn Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.\n\n### Patches\nThis issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.\n\n### Workarounds\nThere is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.","public_affected_ranges":["ECOSYSTEM: introduced 4.0.0-beta.1; fixed 4.3.4"]}],"null_published_at":"2026-10-31T22:13:22.839Z","source_updated_at":"2026-09-02T14:45:06.133Z","source_disclosed_at":"2026-09-02T14:38:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:20.410Z"}],"next_cursor":null,"snapshot_revision":"42594"}