CVE-2026-65971
Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path
CVSS Score
7.6
EPSS Score
0.0%
EPSS Percentile
0th
Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.
| CWE | CWE-89 |
| Vendor | power-components |
| Product | livewire-powergrid |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for power-components livewire-powergrid
Be the first to know when new high vulnerabilities affecting power-components livewire-powergrid are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Affected Versions
Power-Components / livewire-powergrid
>= 6.0.0, < 6.10.4
References
github.com: https://github.com/Power-Components/livewire-powergrid/security/advisories/GHSA-7fgc-3h6c-698r github.com: https://github.com/Power-Components/livewire-powergrid/commit/13d047bf1637e82926e6914aa3ca0f29a4c9704a github.com: https://github.com/Power-Components/livewire-powergrid/releases/tag/v6.10.4