CVE-2025-27517: Volt Allows RCE Via User-Crafted Requests

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-05 · updated 2026-06-17
Weakness: CWE-20

Description

Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0.

Affected products

livewire volt: before 1.7.0

References

https://github.com/livewire/volt/security/advisories/GHSA-v69f-5jxm-hwvv

Get alerted when CVE-2025-27517 or the next vulnerability affects your stack