CVE-2026-65971 · Package
NO FIX YET · SEE WHAT TO DO
Livewire PowerGrid builds data tables on Laravel Livewire and inserts the public sortDirection property directly into a raw SQL ORDER BY clause without restricting it to asc or desc. A remote request to POST /livewire/update can therefore inject arbitrary SQL into the application's database queries.
first public Jul 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications using Livewire PowerGrid versions from 6.0.0 before 6.10.4 that render data tables with sortable columns reachable through the Livewire update endpoint. Applications on earlier or later versions, or without PowerGrid, are not affected. Whether an attacker needs an account is not stated in the sources.
Not affected if no-powergrid, version-6.10.4-or-later
Who cares composer, laravel, livewire, php
livewire-powergrid in composer.lock or with composer show power-components/livewire-powergridlivewire-powergrid 6.10.4 and later (fixed version stated in the sources)Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.