GitHub Advisoryadvisory · Packagist

GHSA-v69f-5jxm-hwvv Volt Allows RCE Via User-Crafted Requests

CRITICAL Published 2025-03-05 Modified 2025-03-05 Official page ↗

Aliases: CVE-2025-27517
Ecosystem: Packagist
Packages: livewire/volt
Severity: Critical
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses: CWE-20
Reviewed: 2025-03-05

Affected packages

• Packagist livewire/volt: < 1.7.0 → fixed in 1.7.0

Description

Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components.

Related

Alias · CVE (1)

CVE-2025-27517 Volt is an elegantly crafted functional API for Livewire. vulnerability

Weakness · CWE (1)

CWE-20 Improper Input Validation weakness

References