PT-2024-10192 · Laravel · Laravel Pulse

Angelej

·

Published

2024-10-12

·

Updated

2025-08-27

·

CVE-2024-55661

CVSS v4.0

9.3

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Laravel Pulse versions prior to 1.3.1
Description A vulnerability has been discovered in Laravel Pulse that could allow remote code execution through the public remember() method in the LaravelPulseLivewireConcernsRemembersQueries trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method that meets the following criteria: the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable component is the remember(callable $query, string $key = '') method in LaravelPulseLivewireConcernsRemembersQueries, and the vulnerability affects all Pulse card components that use this trait.
Recommendations For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider disabling the remember() function in the LaravelPulseLivewireConcernsRemembersQueries trait until a patch is available. Restrict access to the vulnerable LaravelPulseLivewireConcernsRemembersQueries trait to minimize the risk of exploitation. Avoid using the remember() method in Livewire components until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-00521
CVE-2024-55661
GHSA-8VWH-PR89-4MW2

Affected Products

Laravel Pulse