CVE-2024-22859

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-01 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the vendor disputes this because the 5d88731 commit fixes a usability problem (HTTP 419 status codes for legitimate client activity), not a security problem.

Affected products

livewire: before 3.0.4 — fixed in 3.0.4

How to fix

Upgrade to a fixed version: livewire 3.0.4. Check the vendor advisory for mitigations.

References

https://github.com/github/advisory-database/pull/3490
https://github.com/livewire/livewire/commit/5d887316f2aaf83c0e380ac5e72766f19700fa3b
https://github.com/github/advisory-database/pull/3490
https://github.com/livewire/livewire/commit/5d887316f2aaf83c0e380ac5e72766f19700fa3b

Get alerted when CVE-2024-22859 or the next vulnerability affects your stack