CVE-2026-65971

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65971
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65971.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65971
Aliases
  • GHSA-7fgc-3h6c-698r
Published
2026-11-11T21:49:12Z
Modified
2026-11-13T02:47:36Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
Summary
Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path
Details

Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65971.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "6.0.0"
                        },
                        {
                            "fixed": "6.10.4"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "6.10.4"
                        },
                        {
                            "fixed": "6.10.4"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/power-components/livewire-powergrid

Affected ranges

Type
GIT
Repo
https://github.com/power-components/livewire-powergrid
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
13d047bf1637e82926e6914aa3ca0f29a4c9704a
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "13d047bf1637e82926e6914aa3ca0f29a4c9704a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v6.10.4",
            "range": [
                {
                    "fixed": "13d047bf1637e82926e6914aa3ca0f29a4c9704a"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2
v1.*
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.2.10
v1.2.11
v1.2.2
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.4.0
v1.4.1
v1.4.3
v1.4.5
v1.4.6
v1.4.7
v1.5.0
v1.5.1
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.1.1
v2.1.2
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.4.0
v2.4.1
v2.4.10
v2.4.11
v2.4.12
v2.4.13
v2.4.2
v2.4.3
v2.4.4
v2.4.8
v2.4.9
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.1.0
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.2.7
v3.2.8
v3.2.9
v3.3.0
v3.4.0
v3.4.1
v3.5.0
v3.5.1
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.1.0
v4.1.1
v4.1.2
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.5.0
v4.5.1
v4.5.2
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.7.0
v4.7.1
v4.8.0
v5.*
v5.0.0
v5.0.0-beta
v5.0.0-beta.2
v5.0.0-beta.3
v5.0.1
v5.0.2
v5.0.5
v5.0.6
v5.0.7
v5.1.0
v5.1.1
v5.1.10
v5.1.11
v5.1.12
v5.1.13
v5.1.14
v5.1.15
v5.1.16
v5.1.17
v5.1.18
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.1.7
v5.1.8
v5.1.9
v5.10.0
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.2.6
v5.3.0
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v5.3.5
v5.3.6
v5.3.7
v5.3.8
v5.4.0
v5.4.1
v5.4.10
v5.4.11
v5.4.12
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.4.6
v5.4.7
v5.4.8
v5.4.9
v5.5.0
v5.6.0
v5.6.1
v5.6.2
v5.6.3
v5.6.4
v5.7.0
v5.7.1
v5.8.0
v5.8.1
v5.9.0
v6.*
v6.0.0
v6.0.0-beta1
v6.0.0-beta2
v6.0.0-beta3
v6.0.0-beta4
v6.0.0-beta5
v6.0.0-beta6
v6.0.0-beta7
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.1.0
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v6.1.6
v6.1.7
v6.1.8
v6.1.9
v6.10.0
v6.10.1
v6.10.2
v6.10.3
v6.2.0
v6.2.1
v6.2.2
v6.3.0
v6.3.1
v6.3.2
v6.4.0
v6.4.1
v6.4.2
v6.5.0
v6.5.1
v6.5.2
v6.5.3
v6.5.4
v6.5.5
v6.6.0
v6.6.1
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.7.0
v6.7.1
v6.7.2
v6.7.3
v6.7.4
v6.7.5
v6.7.6
v6.7.7
v6.8.0
v6.8.1
v6.8.2
v6.9.0
v6.9.1
v6.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65971.json"