GitHub Advisoryadvisory · npm
GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register
HIGH
Official page ↗
- Aliases
- CVE-2026-105858
- Ecosystem
- npm
- Packages
- payload
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1321, CWE-94
- Reviewed
- 2026-10-07
Affected packages
• npm payload: < 3.90.0 → fixed in 3.90.0
• npm payload: >= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34
Description
Impact
A crafted request to the public first-register operation can be used to perform a RCE exploit.
You are affected if:
• You use local auth strategy and your application remains without an initial user created
Patches
In the patched version data submission to create first user is properly sanitized.
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
Related
Alias · CVE (1)
- CVE-2026-105858 Payload is a free and open source headless content management system. vulnerability
References
- https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv web
- https://nvd.nist.gov/vuln/detail/CVE-2026-105858 advisory
- https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679 web
- https://github.com/payloadcms/payload package
- https://github.com/payloadcms/payload/releases/tag/v3.90.0 web