{"id":"CVE-2024-55661","aliases":["GHSA-8vwh-pr89-4mw2"],"url":"https://o3.security/vulnerability/CVE-2024-55661","summary":"Laravel Pulse Allows Remote Code Execution via Unprotected Query Method","details":"A vulnerability has been discovered in Laravel Pulse that could allow remote code execution through the public `remember()` method in the `Laravel\\Pulse\\Livewire\\Concerns\\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. \n\n### Impact\n\nAn authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method that meets the following criteria:\n\n- The callable is a function or static method\n- The callable has no parameters or no strict parameter types\n\n### Vulnerable Components\n\n- The `remember(callable $query, string $key = '')` method in `Laravel\\Pulse\\Livewire\\Concerns\\RemembersQueries`\n- Affects all Pulse card components that use this trait\n\n### Attack Vectors\n\nThe vulnerability can be exploited through Livewire component interactions, for example:\n\n```php\nwire:click=\"remember('\\\\Illuminate\\\\Support\\\\Facades\\\\Config::all', 'config')\"\n```\n\n### Credit\n\nThank you to Jeremy Angele for reporting this vulnerability.\n","published":"2024-12-13T16:04:51.788Z","modified":"2026-08-12T03:51:22.378863436Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"laravel/pulse","fixedVersion":"1.3.1"}],"fix":{"url":"https://github.com/laravel/pulse/commit/d1a5bf2eca36c6e3bedb4ceecd45df7d002a1ebc","label":"laravel/pulse@d1a5bf2"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55661.json"},{"type":"ADVISORY","url":"https://github.com/laravel/pulse/security/advisories/GHSA-8vwh-pr89-4mw2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55661"},{"type":"FIX","url":"https://github.com/laravel/pulse/commit/d1a5bf2eca36c6e3bedb4ceecd45df7d002a1ebc"},{"type":"PACKAGE","url":"https://github.com/laravel/pulse"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:22.378863436Z"}}