CVE-2026-105856 · GHSA-pj7x-6wpf-pgvp
Payload: SQL injection in SQLite/Postgres
- Risk score
- 59/100
- CVSS
- 8.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without…
- Affected
- @payloadcms/db-sqlite (npm) >= 3.0.0, < 3.90.0; @payloadcms/db-d1-sqlite (npm) >= 3.0.0, < 3.90.0; @payloadcms/db-postgres (npm) >= 3.0.0, < 3.73.0; @payloadcms/db-vercel-postgres (npm) >= 3.0.0, < 3.73.0
- Fix
- Upgrade @payloadcms/db-sqlite to 3.90.0 or 4.0.0-canary.34; @payloadcms/db-d1-sqlite to 3.90.0 or 4.0.0-canary.34; @payloadcms/db-postgres to 3.73.0; @payloadcms/db-vercel-postgres to 3.73.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
@payloadcms/plugin-form-builder: Amber, patch this week. Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
The flaws
- CVE-2026-105856: Payload: SQL injection in SQLite/Postgres (CVSS 8.3 · EPSS 0%)
- CVE-2026-105857: Payload Form Builder has an RCE issue (CVSS 10.0 · EPSS 0%)
- CVE-2026-105859: Payload: Unauthorized update to collection documents (CVSS 9.8 · EPSS 0%)
- CVE-2026-105863: Payload authentication token field handling issue (CVSS 9.4 · EPSS 0%)
The fix
Upgrade @payloadcms/plugin-form-builder: 3.90.0 · 4.0.0 · 3.73.0 or later on your release line
Who is exposed: @payloadcms/plugin-form-builder (npm) < 3.90.0; @payloadcms/plugin-form-builder (npm) >= 4.0.0-canary.0, < 4.0.0-canary.34
Where it stands
- No known exploitation
Connects to
- Same weakness: SQL injection (CWE-89). 400 other warnings in 30 days
- Same product: Earlier @payloadcms/db-sqlite warnings. 20 in the last 90 days
Why it is Yellow
- CVSS 8.3 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @payloadcms/db-sqlite | npm | >= 3.0.0, < 3.90.0 | 3.90.0 |
| @payloadcms/db-d1-sqlite | npm | >= 3.0.0, < 3.90.0 | 3.90.0 |
| @payloadcms/db-postgres | npm | >= 3.0.0, < 3.73.0 | 3.73.0 |
| @payloadcms/db-vercel-postgres | npm | >= 3.0.0, < 3.73.0 | 3.73.0 |
| @payloadcms/db-sqlite | npm | >= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| @payloadcms/db-d1-sqlite | npm | >= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
References
- https://github.com/advisories/GHSA-pj7x-6wpf-pgvp
- https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp
- https://nvd.nist.gov/vuln/detail/CVE-2026-105856
- https://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
- https://github.com/advisories/GHSA-pj7x-6wpf-pgvp
Original description
Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite packages are fixed in versions 3.90.0 and 4.0.0-canary.34, and the Postgres packages are fixed in version 3.73.0.
Last activity 6 Oct 2026. Patch Forecast updates every hour.