CVE-2026-81887

Executive Summary

CVE-2026-81887 is a client-side prototype pollution vulnerability in Livewire, a full-stack framework for Laravel, affecting versions 3.0.0-beta.1 through 3.8.2 and 4.0.0 through 4.3.3. An unauthenticated attacker can craft a malicious URL containing dot-notation query-string parameters with __proto__, constructor, or prototype path segments. When a victim opens this URL, the framework's query-string parser in js/plugins/history/index.js — specifically the fromQueryString() and insertDotNotatedValueIntoData() functions — pollutes the JavaScript Object.prototype, causing inherited attacker-controlled state to be interpreted as trusted Livewire server responses. This leads to arbitrary JavaScript execution in the context of the affected application's origin. Exploitation requires user interaction (clicking a link) and does not bypass server-side authorization, but it can result in session hijacking, data exfiltration, or full client-side compromise of the victim's session.

The vulnerability is fixed in Livewire 3.8.3 and 4.3.4. As of the date of this report, there is no evidence of exploitation in the wild, no public PoC, and no CISA KEV listing. The official CVSS score has not been published by the vendor; however, given the requirement for user interaction and the lack of authorization bypass, the likely severity is moderate. Patch confidence is rated 0/4 — meaning no external patch confirmation has been observed from tracked sources, although the vendor's NVD description explicitly states the fix exists in the two named versions.

Technical Analysis

Livewire is a full-stack framework for Laravel that provides dynamic front-end behavior (like SPA-style updates) without requiring a separate JavaScript framework. On the client side, Livewire maintains a history plugin that parses the current URL's query string to restore or synchronize component state. The vulnerable logic resides in two functions: fromQueryString() and insertDotNotatedValueIntoData(), both located in js/plugins/history/index.js.

Vulnerability Mechanism

The framework uses a dot-notated query-string parser. A query string like ?foo.bar=baz is parsed and converted into a nested JavaScript object, e.g., { foo: { bar: "baz" } }. The flaw is that when the parser encounters path segments equal to __proto__, constructor, or prototype, it does not sanitize or reject them. Instead, it assigns values into the object's prototype chain.

Concretely, a query string such as:

?__proto__[effects][html]=<img+src=x+onerror=alert(1)>

would cause the parser to set Object.prototype.effects.html to the attacker-controlled value. In standard JavaScript, assigning to __proto__ mutates the prototype of the target object, meaning every subsequent object created in the page inherits this property.

The second part of the flaw occurs in the client-side state handlers. After the URL is parsed, Livewire's internal state handler reads several properties:

• effects.html
• effects.js
• effects.xjs
• effects.scripts

These property accesses are performed without using Object.prototype.hasOwnProperty.call() — i.e., without verifying that these properties belong to the object itself rather than being inherited from the prototype. Therefore, the polluted Object.prototype properties are treated as trusted effects returned by the Livewire server. The content of these properties is then executed or rendered — effects.js and effects.scripts contain JavaScript that is evaluated in the page's origin, and effects.html is injected into the DOM.

Additionally, because the prototype pollution is global (affecting Object.prototype), it can persist across Livewire component updates within the same page session, meaning the attacker-controlled effect may survive initial page load and affect subsequent interactions.

Attack Surface

• Attack vector: Network (HTTP route via crafted URL), requiring victim interaction.
• Attack complexity: Low — the attacker only needs to craft a URL; no authentication is required on the attacker's side.
• Privileges required: None (unauthenticated attack).
• User interaction: Required — the victim must click the malicious link (e.g., via phishing or social engineering).

Impact Scope

The vulnerability class is client-side prototype pollution leading to DOM-XSS. Because the polluted property is treated as a trusted Livewire server response, the payload may bypass any client-side input sanitization or CSP that expects server-originated content to be safe. The arbitrary JavaScript executes in the origin of the affected application, meaning it can:

• Read and exfiltrate all document.cookie values that are not HttpOnly.
• Access any localStorage / sessionStorage keys.
• Perform authenticated AJAX requests to the application on behalf of the victim.
• Deface the page or inject keyloggers.

Affected Versions

• Livewire 3.x: 3.0.0-beta.1 through 3.8.2 (fixed in 3.8.3)
• Livewire 4.x: 4.0.0 through 4.3.3 (fixed in 4.3.4)

Any Laravel application using Livewire within these ranges is at risk.

Exploitation Scenarios

Attack Chain Overview

1. Reconnaissance / Target Identification

   • The attacker identifies a target website. Since Livewire is a front-end framework, the attacker can fingerprint it by:
     • Inspecting page source for livewire identifiers, wire: attributes (e.g., wire:click, wire:model), or the presence of /livewire/message endpoint calls.
     • Using Shodan or Google dorks such as http.html:"livewire" or http.html:"wire:click" to find exposed applications.
   • The attacker confirms the application version by checking the Livewire JavaScript bundle or observing behavior that differs between patched and unpatched versions (e.g., use of Object.prototype.hasOwnProperty in the minified bundle).

2. Triggering the Flaw Class

   • The vulnerability class is Client-Side Prototype Pollution via URL Query String.
   • The attacker crafts a URL targeting the vulnerable application, inserting query-string parameters that include __proto__, constructor, or prototype path segments. The exact parameter names are not specified in public data; however, the parser processes any dot-notated query-string key.
   • Example conceptual URL (illustrative, not a confirmed payload):

     https://victim-app.com/dashboard?__proto__[effects][js]=alert(document.cookie)
     

   • The malicious query string is processed by fromQueryString() upon page load.

3. Payload / Execution Method

   • The parser calls insertDotNotatedValueIntoData() which assigns the value into Object.prototype.
   • When Livewire's client-side state handler subsequently accesses effects.js (or effects.xjs, effects.scripts) without hasOwnProperty checks, it retrieves the inherited attacker-controlled value.
   • The JavaScript payload is then evaluated / executed in the context of the page origin, resulting in arbitrary script execution.
   • The attacker may also set effects.html to inject malicious HTML into the DOM, which could be used for phishing or credential harvesting.

4. Post-Exploitation Impact

   • Session Hijacking: Steal session cookies (if not HttpOnly) and hijack the victim's session.
   • Data Exfiltration: Read sensitive data displayed on the page or accessible via API calls, and send it to attacker-controlled endpoints.
   • Account Takeover: If the application has profile settings or admin features, the attacker could perform actions as the victim (e.g., change email/password) if those actions are not protected by CSRF tokens or require re-authentication.
   • Persistence (client-side): Because prototype pollution persists for the lifetime of the page session, the attacker's payload remains active across all subsequent component updates until the page is fully reloaded.

Important Caveats:

• No public PoC is available at this time; the attack chain above is inferred strictly from the vulnerability class and the mechanism described in the NVD entry. Specific parameter names beyond those mentioned in the description (__proto__, constructor, prototype) have not been publicly disclosed.
• The attack does not bypass server-side authorization. The victim's session is used as-is; the attacker gains no higher privilege than the victim has.

Impact Assessment

Business Impact:

• Confidentiality: High — attacker can exfiltrate cookies, tokens, sensitive page data, and perform API requests as the victim.
• Integrity: Medium — attacker can modify client-side state, display fake content, or silently alter forms.
• Availability: Low — the attack does not degrade server availability; however, the attacker could force client-side crashes or resource exhaustion via infinite loops in injected JS.

Affected Systems:

• Any Laravel application using Livewire 3.x (< 3.8.3) or 4.x (< 4.3.4). Livewire is widely used for building interactive admin panels, dashboards, and CRUD interfaces — often privileged areas. This significantly increases the risk of session theft in high-value targets.

Blast Radius:

• The vulnerability is client-side only; the server itself is not compromised. However, because it requires only a crafted link and no authentication, the blast radius spans all users of the affected application who can be tricked into clicking the malicious URL.
• If the application is an admin panel, a successful attack on an admin user could lead to full account takeover and subsequent server-side abuse of admin privileges (via the session).

CVSS Considerations:

• The vendor has not yet published a CVSS score. Based on the characteristics (network vector, low complexity, no privileges, user interaction required, high confidentiality impact, low integrity/availability impact), an estimate would place this in the moderate range (CVSS 3.x: ~6.1-6.4). This assessment is an estimate and does not override the official N/A status.

EPSS:

• Not yet scored by FIRST.org; no exploitation probability data is available.

Detection Guidance

Given the client-side nature of this vulnerability, detection is challenging from a network-only perspective because the exploit is delivered via a regular HTTPS request containing a crafted query string. The malicious payload may be encoded or split across parameters. The following detection content focuses on:

• Network-level detection of characterized query-string pollution attempts.
• Server-log analysis for suspicious query parameters.
• Client-side behavioral detection is outside the scope of these rules (requires RUM or browser instrumentation).

Sigma Rule

title: Livewire Prototype Pollution Query String Attempt
id: 6f8a9c2e-4d7b-4e3a-9f81-2c7d4b0a8e1f
status: experimental
description: Detects HTTP requests containing query-string parameters with __proto__, constructor, or prototype path segments targeting applications that may use Livewire.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-81887
author: Valtersit Threat Intel
date: 2026/03/01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        c-uri|contains|all:
            - '__proto__'
            - 'constructor'
            - 'prototype'
    condition: selection
falsepositives:
    - Legitimate API calls that coincidentally use these words as parameter names (rare)
level: high
tags:
    - attack.t1204.001
    - cwe.79

YARA Rule

rule Livewire_Prototype_Pollution_JS {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects presence of vulnerable Livewire history parser functions or prototype pollution patterns in served JavaScript."
        date = "2026-03-01"
        reference = "CVE-2026-81887"
        severity = "high"
    strings:
        $func1 = "fromQueryString" ascii wide
        $func2 = "insertDotNotatedValueIntoData" ascii wide
        $proto1 = "__proto__" ascii wide
        $proto2 = "constructor" ascii wide
        $proto3 = "prototype" ascii wide
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and  // PE or ELF — unlikely for JS, so broader check:
        ($func1 or $func2) and (2 of ($proto*))
        // OR simply scan raw JS files:
        or ($func1 and ($proto1 or $proto2 or $proto3))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-81887 Livewire Prototype Pollution Query String"; flow:to_server,established; http.uri; content:"__proto__"; nocase; http.uri; content:"constructor"; nocase; http.uri; content:"prototype"; nocase; classtype:attempted-user-exec; sid:2026081887; rev:1; metadata:created_at 2026_03_01, updated_at 2026_03_01;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [network where process.executable != null and process.name == "nginx" or process.name == "apache2" or process.name == "httpd" and
   destination.port == 443 and
   url.path : "*" and
   (url.query : "*__proto__*" or url.query : "*constructor*" or url.query : "*prototype*")]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_query="*__proto__*" OR uri_query="*constructor*" OR uri_query="*prototype*"
| eval proto_pollution = if(uri_query LIKE "%__proto__%" OR uri_query LIKE "%constructor%" OR uri_query LIKE "%prototype%", "Suspicious", "Normal")
| where proto_pollution="Suspicious"
| stats count by src_ip, uri, http_method, user_agent, _time
| sort - count

Wazuh OSSEC Rule

<group name="web,_livewire,">
    <rule id="100287" level="12">
        <if_sid>31100</if_sid>
        <match>__proto__|constructor|prototype</match>
        <description>CVE-2026-81887 - Possible Livewire prototype pollution query string in request</description>
        <group>attack.t1204.001,cwe.79,</group>
        <mitre>
            <id>T1204.001</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (per patch evidence sources).

Note: Despite the vendor's NVD description indicating fixes in versions 3.8.3 and 4.3.4, the "Patch Confidence" data supplied for this report rates 0/4, meaning no external patch confirmation has been observed from tracked sources. Treat this with caution — verify patch availability directly with the vendor or via official release notes before assuming the fix is publicly available.

1. Immediate Mitigations (if patching is not immediately possible)

• Server-side URL filtering: Configure a reverse proxy or WAF (e.g., ModSecurity, nginx if block) to reject or sanitize any request URI containing __proto__, constructor, or prototype as query-string parameter names. Apply this at the web server layer before the request reaches the application.
• CSP hardening: Enforce a strict Content-Security-Policy that disallows unsafe-inline for scripts and restricts script-src to trusted sources. This may prevent execution of injected inline JavaScript, though it is not a complete defense if the payload is delivered via externally hosted scripts.
• Session hardening: Ensure all sensitive session cookies use HttpOnly and Secure flags. Consider setting SameSite=Lax or Strict to mitigate cross-site request forgery leveraging the victim's session.
• User education: Advise users, especially administrators, not to click on unsolicited or suspicious links.

2. Patch / Upgrade Steps

1. Identify Livewire version: Run composer show livewire/livewire in the project root to determine the installed version.
2. Upgrade to a fixed version:
   • If using Livewire 3.x: upgrade to 3.8.3 or later.
   • If using Livewire 4.x: upgrade to 4.3.4 or later.
3. Command: composer require livewire/livewire:^3.8.3 (or ^4.3.4) then composer update livewire/livewire.
4. Clear caches: After upgrading, clear the view and route caches (php artisan optimize:clear).
5. Verify: Confirm the fix by checking that the fromQueryString() function in the served JavaScript now uses Object.prototype.hasOwnProperty.call() or rejects prototype path segments.

3. Long-Term Hardening

• Framework maintenance: Establish a schedule for applying framework and dependency updates within 48 hours of release for security-related fixes.
• Web application firewall: Deploy a WAF with rules specifically targeting prototype pollution payloads (e.g., __proto__, constructor[, prototype[).
• Code review: For any custom client-side JavaScript that traverses object properties, adopt a policy of using Object.prototype.hasOwnProperty.call() or Object.hasOwn() when accessing dynamic keys.
• Monitoring: Implement alerting on the detection rules provided above (Sigma, Suricata, Splunk, etc.) in SIEM / IDS systems.
• Laravel advisor: Subscribe to Laravel and Livewire security advisories.

References

1. NVD Entry: CVE-2026-81887 — NVD — Official vulnerability description and affected version ranges.
2. Livewire Official Repository: livewire/livewire on GitHub — Monitor releases and security fixes for 3.8.3 and 4.3.4.
3. CWE-79 Reference: CWE-79 — Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting weakness class.
4. Mitre ATT&CK: T1204.001 — User Execution: Malicious Link — Corresponding technique for phishing/link-based delivery.

Threat Actor / Exploit-in-the-Wild Status:

• CISA KEV: Not listed — no known exploitation in the wild per CISA.
• PoC/Exploit: None public at the time of writing.
• Nuclei Template: None available.
• Known Campaigns: No threat actor campaigns have been attributed to this CVE as of the report date. This may change once public PoCs emerge; monitor vendor and security community channels.