CVE-2024-55661

Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method in which the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable to component is `remember(callable $query, string $key = '')` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries`, and the vulnerability affects all Pulse card components that use this trait. Version 1.3.1 contains a patch.

• CWE-94

• https://github.com/laravel/pulse/commit/d1a5bf2eca36c6e3bedb4ceecd45df7d002a1ebcPatch
• https://github.com/laravel/pulse/security/advisories/GHSA-8vwh-pr89-4mw2Vendor Advisory

Published

Dec 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55656RedisBloom adds a set of probabilistic data structures to Re…8.8
• CVE-2024-55657SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2024-55658SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2024-55659SiYuan is a personal knowledge management system. Prior to v…5.4
• CVE-2024-5566An improper privilege management vulnerability allowed users…6.5
• CVE-2024-55660SiYuan is a personal knowledge management system. Prior to v…9.8
• CVE-2024-55662XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-55663XWiki Platform is a generic wiki platform. Starting in versi…9.8
• CVE-2024-5567The Betheme theme for WordPress is vulnerable to Stored Cros…5.4
• CVE-2024-5569A Denial of Service (DoS) vulnerability exists in the jaraco…6.2
• CVE-2024-5570The Simple Photoswipe WordPress plugin through 0.1 does not …6.5
• CVE-2024-5571The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embe…5.4