GHSA-pj7x-6wpf-pgvp

Source

https://github.com/advisories/GHSA-pj7x-6wpf-pgvp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pj7x-6wpf-pgvp/GHSA-pj7x-6wpf-pgvp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pj7x-6wpf-pgvp

Aliases

CVE-2026-105856

Published

2026-10-07T20:30:04Z

Modified

2026-10-07T20:45:04Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Payload: SQL injection in SQLite/Postgres

Details

Impact

An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres.

You are affected if:

You use @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite.
You use @payloadcms/db-postgres or @payloadcms/db-vercel-postgres < 3.73.0.
A readable collection has a json field, or a blocks field with blocksAsJSON: true.
The attacker has read plus create or update access on it.

You are not affected if:

You have no json or blocksAsJSONfields.richText` is not affected.
You run a patched version.

Patches

The patched version sanitizes the query input to prevent injection.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:30:04Z",
    "nvd_published_at": "2026-10-06T17:17:21Z",
    "severity": "HIGH"
}

References

Affected packages

npm

@payloadcms/db-sqlite

Package

Name: @payloadcms/db-sqlite; View open source insights on deps.dev
Purl: pkg:npm/%40payloadcms/db-sqlite

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.90.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pj7x-6wpf-pgvp/GHSA-pj7x-6wpf-pgvp.json"

@payloadcms/db-d1-sqlite

Package

Name: @payloadcms/db-d1-sqlite; View open source insights on deps.dev
Purl: pkg:npm/%40payloadcms/db-d1-sqlite

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.90.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pj7x-6wpf-pgvp/GHSA-pj7x-6wpf-pgvp.json"

@payloadcms/db-postgres

Package

Name: @payloadcms/db-postgres; View open source insights on deps.dev
Purl: pkg:npm/%40payloadcms/db-postgres

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.73.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pj7x-6wpf-pgvp/GHSA-pj7x-6wpf-pgvp.json"

@payloadcms/db-vercel-postgres

Package

Name: @payloadcms/db-vercel-postgres; View open source insights on deps.dev
Purl: pkg:npm/%40payloadcms/db-vercel-postgres

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.73.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pj7x-6wpf-pgvp/GHSA-pj7x-6wpf-pgvp.json"

@payloadcms/db-sqlite

Package

Name: @payloadcms/db-sqlite; View open source insights on deps.dev
Purl: pkg:npm/%40payloadcms/db-sqlite

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0-canary.0

Fixed

4.0.0-canary.34

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pj7x-6wpf-pgvp/GHSA-pj7x-6wpf-pgvp.json"

@payloadcms/db-d1-sqlite

Package

Name: @payloadcms/db-d1-sqlite; View open source insights on deps.dev
Purl: pkg:npm/%40payloadcms/db-d1-sqlite

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0-canary.0

Fixed

4.0.0-canary.34

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pj7x-6wpf-pgvp/GHSA-pj7x-6wpf-pgvp.json"