{"id":"CVE-2026-65971","kind":"vulnerability","aliases":["CVE-2026-65971"],"related":[],"title":"Livewire PowerGrid: sort direction input allows SQL injection in data tables","description":"Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.","summary":"Livewire PowerGrid builds data tables on Laravel Livewire and inserts the public sortDirection property directly into a raw SQL ORDER BY clause without restricting it to asc or desc. A remote request to POST /livewire/update can therefore inject arbitrary SQL into the application's database queries.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["composer","laravel","livewire","package","php"],"not_affected_if":["no-powergrid","version-6.10.4-or-later"],"how_to_check":"- Check the installed version of `livewire-powergrid` in `composer.lock` or with `composer show power-components/livewire-powergrid`\n- Confirm whether the application exposes PowerGrid tables to unauthenticated or public users","fix":"- `livewire-powergrid` `6.10.4` and later (fixed version stated in the sources)","status":"open","published_at":"2026-11-11T22:17:28+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:31:53+00:00","updated_at":"2026-11-11T22:31:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T22:31:53Z","model":"claude-haiku-5-5","output":{"fix":"- `livewire-powergrid` `6.10.4` and later (fixed version stated in the sources)","reach":"internet","title":"Livewire PowerGrid: sort direction input allows SQL injection in data tables","impact":"high","summary":"Livewire PowerGrid builds data tables on Laravel Livewire and inserts the public sortDirection property directly into a raw SQL ORDER BY clause without restricting it to asc or desc. A remote request to POST /livewire/update can therefore inject arbitrary SQL into the application's database queries.","audience":"developers","category":"package","nicknames":[],"who_cares":["laravel","livewire","php","composer"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads or changes database contents through injected SQL","analyst_note":"Check the vendor advisory and the NVD entry to confirm whether authentication is required and whether the sortable-column conditions are default.","how_to_check":"- Check the installed version of `livewire-powergrid` in `composer.lock` or with `composer show power-components/livewire-powergrid`\n- Confirm whether the application exposes PowerGrid tables to unauthenticated or public users","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-6.10.4-or-later","no-powergrid"],"who_is_affected":"Applications using Livewire PowerGrid versions from 6.0.0 before 6.10.4 that render data tables with sortable columns reachable through the Livewire update endpoint. Applications on earlier or later versions, or without PowerGrid, are not affected. Whether an attacker needs an account is not stated in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000775,"input_tokens":4617,"output_tokens":627,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65971':14A,17A '/livewire/update':57B,113C '6.0.0':81C '6.10.4':85C,121C 'allow':6A,107C 'applic':65B 'arbitrari':61B,108C 'asc':49B 'asc/desc':106C 'base':74C 'build':25B 'claus':44B,100C 'compos':18B 'creat':71C 'cve':12A,15A 'data':10A,26B,72C 'databas':67B 'desc':51B 'direct':4A,37B 'inject':8A,60B,110C 'input':5A 'insert':32B 'interpol':92C 'issu':115C 'laravel':19B,29B,76C 'librari':78C 'livewir':1A,20B,23B,30B,69C,77C,88C 'order':42B,98C 'packag':21B 'patch':118C 'php':22B 'post':56B,112C 'powergrid':2A,24B,70C 'properti':36B,89C 'public':34B,87C 'queri':68B 'raw':40B,96C 'remot':53B 'request':54B 'restrict':46B,104C 'sort':3A 'sortdirect':35B,90C 'sql':7A,41B,62B,97C,109C 'tabl':11A,27B,73C 'therefor':59B 'verbatim':93C 'version':80C,84C,120C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Applications using Livewire PowerGrid versions from 6.0.0 before 6.10.4 that render data tables with sortable columns reachable through the Livewire update endpoint. Applications on earlier or later versions, or without PowerGrid, are not affected. Whether an attacker needs an account is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["composer","high","laravel","livewire","package","php"],"campaign_type":null,"search_a":"'-2026':13A,16A '-65971':14A,17A 'allow':6A 'cve':12A,15A 'data':10A 'direct':4A 'inject':8A 'input':5A 'livewir':1A 'powergrid':2A 'sort':3A 'sql':7A 'tabl':11A","search_b":"'/livewire/update':57B 'applic':65B 'arbitrari':61B 'asc':49B 'build':25B 'claus':44B 'compos':18B 'data':26B 'databas':67B 'desc':51B 'direct':37B 'inject':60B 'insert':32B 'laravel':19B,29B 'livewir':20B,23B,30B 'order':42B 'packag':21B 'php':22B 'post':56B 'powergrid':24B 'properti':36B 'public':34B 'queri':68B 'raw':40B 'remot':53B 'request':54B 'restrict':46B 'sortdirect':35B 'sql':41B,62B 'tabl':27B 'therefor':59B 'without':45B","search_c":"'/livewire/update':113C '6.0.0':81C '6.10.4':85C,121C 'allow':107C 'arbitrari':108C 'asc/desc':106C 'base':74C 'claus':100C 'creat':71C 'data':72C 'inject':110C 'interpol':92C 'issu':115C 'laravel':76C 'librari':78C 'livewir':69C,77C,88C 'order':98C 'patch':118C 'post':112C 'powergrid':70C 'properti':89C 'public':87C 'raw':96C 'restrict':104C 'sortdirect':90C 'sql':97C,109C 'tabl':73C 'verbatim':93C 'version':80C,84C,120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T13:13:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65971","severity":null,"published_at":"2026-11-11T22:17:28+00:00","modified_at":"2026-11-11T22:17:28+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null}],"documents":[{"id":129425,"url":"https://github.com/Power-Components/livewire-powergrid/commit/13d047bf1637e82926e6914aa3ca0f29a4c9704a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129426,"url":"https://github.com/Power-Components/livewire-powergrid/releases/tag/v6.10.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129427,"url":"https://github.com/Power-Components/livewire-powergrid/security/advisories/GHSA-7fgc-3h6c-698r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T13:13:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}