CVE-2026-65971: Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path
Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Livewire PowerGridto a version that resolves this vulnerability.Fixed in 6.10.4
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Livewire PowerGrid from version 6.0.0 through versions before 6.10.4 are affected when the naturalSort order-by path is reachable. Version 6.10.4 contains the patch.
What access does an attacker need?
An attacker needs low-level privileges and network access to send a POST request to /livewire/update. No user interaction is required.
Is public exploit information available?
Yes. A proof of concept was published on 2026-07-23.
What should be done if an immediate upgrade is not possible?
The provided data identifies the vulnerable input as the public sortDirection Livewire property in requests to /livewire/update. Restrict access to affected functionality to trusted, authenticated users until upgrading to 6.10.4 is possible.