Patch Forecast
Amber warning
Patch this week.

CVE-2026-105844 · GHSA-qf28-8hc6-vwrp

Payload: Prototype pollution in Payload Import Export plugin

Risk score
74/100
CVSS
9.3 v4.0
Exploit chance (30 days)
0.5%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can le…
Affected
@payloadcms/plugin-import-export (npm) >= 3.0.0, < 3.88.0; @payloadcms/plugin-import-export (npm) >= 4.0.0-canary.0, < 4.0.0-canary.27
Fix
Upgrade @payloadcms/plugin-import-export to 3.88.0 or 4.0.0-canary.27 (whichever matches your release line) or later.
Exploitation
No known exploitation

Why it is Amber

  • CVSS 9.3 critical
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@payloadcms/plugin-import-exportnpm>= 3.0.0, < 3.88.03.88.0
@payloadcms/plugin-import-exportnpm>= 4.0.0-canary.0, < 4.0.0-canary.274.0.0-canary.27

References

Original description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Last activity 6 Oct 2026. Patch Forecast updates every hour.