GitHub Advisoryadvisory · npm

GHSA-xx6w-jxg9-2wh8 @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

CRITICAL Published 2026-02-05 Modified 2026-02-07 Official page ↗
Aliases
CVE-2026-25544
Ecosystem
npm
Packages
@payloadcms/drizzle
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2026-02-05

Affected packages

• npm @payloadcms/drizzle: < 3.73.0 → fixed in 3.73.0

Description

Impact When querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL Injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. Users are affected if ALL of these are true: 1. Payload version false }` Patches Upgrade to Payload v3.73.0 or later. Workarounds If a project cannot upgrade immediately, add `access: { read: () => false }` to all JSON and richText fields as a temporary mitigation.

Related

Alias · CVE (1)

  • CVE-2026-25544 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References