{"action":"Upgrade livewire/livewire to 3.8.3 or later.","affected":[{"fixed":"3.8.3","introduced":"3.0.0-beta.1"},{"fixed":"4.3.4","introduced":"4.0.0-beta.1"}],"component":"livewire/livewire","cve_ids":["CVE-2026-81887"],"ecosystem":"Packagist","epss":0.00682,"exploited":false,"fixed_versions":["3.8.3","4.3.4"],"ghsa_id":"GHSA-g3hc-697w-wm82","id":"tcs_01M5KF288DDDC7P4MZSAN6C0JX","modified_at":"2026-09-02T14:45:06.133648877Z","published_at":"2026-09-02T14:38:58Z","references":["https://osv.dev/vulnerability/GHSA-g3hc-697w-wm82","https://github.com/livewire/livewire/security/advisories/GHSA-g3hc-697w-wm82","https://nvd.nist.gov/vuln/detail/CVE-2026-81887","https://github.com/livewire/livewire/pull/10467","https://github.com/livewire/livewire/commit/11ebe646f7e81dde2d714815da8b3019d058561e","https://github.com/livewire/livewire","https://github.com/livewire/livewire/releases/tag/v3.8.3","https://github.com/livewire/livewire/releases/tag/v4.3.4"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-g3hc-697w-wm82","url":"https://osv.dev/vulnerability/GHSA-g3hc-697w-wm82"}],"summary":"Livewire DOM-based cross-site scripting during client-side state handling"}