High severity7.6NVD Advisory· Published Nov 11, 2026

CVE-2026-65971

Description

Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.

Affected products

Power Components/Livewire Powergridreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 6.0.0 <= v < 6.10.4

Patches

Vulnerability mechanics

References

github.com/Power-Components/livewire-powergrid/commit/13d047bf1637e82926e6914aa3ca0f29a4c9704anvd
github.com/Power-Components/livewire-powergrid/releases/tag/v6.10.4nvd
github.com/Power-Components/livewire-powergrid/security/advisories/GHSA-7fgc-3h6c-698rnvd

News mentions

No linked articles in our index yet.

cvss	0.494
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000