GitHub Advisoryadvisory · npm
GHSA-v49j-62m6-pgrr Payload: SQL Injection in SQLite and Postgres
CRITICAL
Official page ↗
- Aliases
- CVE-2026-105845
- Ecosystem
- npm
- Packages
- payload
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
- Reviewed
- 2026-10-06
Affected packages
• npm payload: >= 3.0.0, < 3.88.0 → fixed in 3.88.0
• npm payload: >= 4.0.0-canary.0, < 4.0.0-canary.27 → fixed in 4.0.0-canary.27
Description
Impact
A user can submit a request that exploits a SQL Injection vulnerability in Payload.
You are affected if:
• You use an affected Payload version.
• Untrusted users can query readable collections using dynamic filters or joins.
You are not affected if you use MongoDB (`@payloadcms/mongodb`).
Patches
Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`.
Workarounds
Upgrading to a patched version is recommended. Until you can upgrade, restrict untrusted users from supplying dynamic query filters or join parameters and limit read access to affected collections.
Related
Alias · CVE (1)
- CVE-2026-105845 Payload is a free and open source headless content management system. vulnerability
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness