AIKIDO-2026-888106

TL;DR

The public Livewire sortDirection property is interpolated verbatim into a raw ORDER BY clause built for the naturalSort feature and is not restricted to asc or desc. Setting sortField to an empty string skips the sorting pipeline that normally validates the direction, so the raw-query pipeline still applies the tainted value through orderByRaw. This lets externally supplied input inject arbitrary SQL into the order clause, enabling blind boolean and time-based extraction of database contents. The fix sanitizes the sort direction against an allowlist before it reaches the query.