GitHub Advisoryadvisory · npm

GHSA-qf28-8hc6-vwrp Payload: Prototype pollution in Payload Import Export plugin

CRITICAL Published 2026-10-06 Modified 2026-10-06 Official page ↗
Aliases
CVE-2026-105844
Ecosystem
npm
Packages
@payloadcms/plugin-import-export
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-1321
Reviewed
2026-10-06

Affected packages

• npm @payloadcms/plugin-import-export: >= 3.0.0, < 3.88.0 → fixed in 3.88.0 • npm @payloadcms/plugin-import-export: >= 4.0.0-canary.0, < 4.0.0-canary.27 → fixed in 4.0.0-canary.27

Description

Impact An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE). Applications that do not use `@payloadcms/plugin-import-export` are not affected. Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27.` Workarounds Upgrading is recommended. Until then, disable the Import Export plugin or restrict access to its endpoints.

Related

Alias · CVE (1)

  • CVE-2026-105844 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References