All vulnerabilities
CVE-2026-105844GHSA-qf28-8hc6-vwrp

@payloadcms/plugin-import-export: Payload: Prototype pollution in Payload Import Export plugin

payloadcms @payloadcms/plugin-import-exportnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.88.0Also 4.0.0-canary.27GitHub
Published6 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 3.88.0@payloadcms/plugin-import-export, npmGitHubnpm install @payloadcms/plugin-import-export@3.88.0
  • 4.0.0-canary.27@payloadcms/plugin-import-export, npmGitHubnpm install @payloadcms/plugin-import-export@4.0.0-canary.27

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE).

Applications that do not use @payloadcms/plugin-import-export are not affected.

Patches

Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.

Workarounds

Upgrading is recommended. Until then, disable the Import Export plugin or restrict access to its endpoints.

Text from GitHub Advisory Database

Affected versions 8

  • @payloadcms/plugin-import-export, npm>= 3.0.0, < 3.88.0GitHub
  • @payloadcms/plugin-import-export, npm>= 4.0.0-canary.0, < 4.0.0-canary.27GitHub
  • payloadaffected: >= 3.0.0, < 3.88.0CVE List
  • payloadaffected: >= 4.0.0-canary.0, < 4.0.0-canary.27CVE List
  • plugin-import-exportaffected: >= 3.0.0, < 3.88.0CVE List
  • plugin-import-exportaffected: >= 4.0.0-canary.0, < 4.0.0-canary.27CVE List
  • @payloadcms/plugin-import-export, npmfrom 3.0.0, fixed in 3.88.0OSV
  • @payloadcms/plugin-import-export, npmfrom 4.0.0-canary.0, fixed in 4.0.0-canary.27OSV

References 4