All vulnerabilities
CVE-2026-63316CVE-2026-105856GHSA-pj7x-6wpf-pgvp

SQL Injection in Payload CMS

Payload Payload CMSnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.90.0Also 4.0.0-canary.34, 3.73.0CVE List
Published13 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 3.90.0Payload CMSCVE List
  • 4.0.0-canary.34Payload CMSCVE List
  • 3.90.0@payloadcms/db-sqlite, npmOSVnpm install @payloadcms/db-sqlite@3.90.0
  • 3.90.0@payloadcms/db-d1-sqlite, npmOSVnpm install @payloadcms/db-d1-sqlite@3.90.0
  • 3.73.0@payloadcms/db-postgres, npmOSVnpm install @payloadcms/db-postgres@3.73.0
  • 3.73.0@payloadcms/db-vercel-postgres, npmOSVnpm install @payloadcms/db-vercel-postgres@3.73.0
Show all 8 fixed versions
  • 4.0.0-canary.34@payloadcms/db-sqlite, npmOSVnpm install @payloadcms/db-sqlite@4.0.0-canary.34
  • 4.0.0-canary.34@payloadcms/db-d1-sqlite, npmOSVnpm install @payloadcms/db-d1-sqlite@4.0.0-canary.34

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks.

This issue was fixed in version 3.90.0 and 4.0.0-canary.34.

Text from CVE List

Affected versions 8

  • Payload CMSaffected: all versions before 3.90.0CVE List
  • Payload CMSaffected: 4.0.0-canary.0 before 4.0.0-canary.34CVE List
  • @payloadcms/db-sqlite, npmfrom 3.0.0, fixed in 3.90.0OSV
  • @payloadcms/db-d1-sqlite, npmfrom 3.0.0, fixed in 3.90.0OSV
  • @payloadcms/db-postgres, npmfrom 3.0.0, fixed in 3.73.0OSV
  • @payloadcms/db-vercel-postgres, npmfrom 3.0.0, fixed in 3.73.0OSV
  • @payloadcms/db-sqlite, npmfrom 4.0.0-canary.0, fixed in 4.0.0-canary.34OSV
  • @payloadcms/db-d1-sqlite, npmfrom 4.0.0-canary.0, fixed in 4.0.0-canary.34OSV

References 2