CVE-2026-65971

CVSS 7.6 (high) · published 2026-11-11

Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.

Weakness: CWE-89

Source: NVD CVE-2026-65971

References

• https://github.com/Power-Components/livewire-powergrid/commit/13d047bf1637e82926e6914aa3ca0f29a4c9704a
• https://github.com/Power-Components/livewire-powergrid/releases/tag/v6.10.4
• https://github.com/Power-Components/livewire-powergrid/security/advisories/GHSA-7fgc-3h6c-698r
• https://github.com/Power-Components/livewire-powergrid/security/advisories/GHSA-7fgc-3h6c-698r

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.