GitHub Advisoryadvisory · npm

GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript

HIGH Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-105868
Ecosystem
npm
Packages
payload
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-434
Reviewed
2026-10-07

Affected packages

• npm payload: < 3.90.0 → fixed in 3.90.0 • npm payload: >= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34

Description

Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. You are affected if: • You accept XML uploads (accepted by default). Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. Workarounds Disallow XML/XSL uploads.

Related

Alias · CVE (1)

  • CVE-2026-105868 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References