~ / search / GHSA-9qpg-3cf8-w33x

GHSA-9qpg-3cf8-w33x

Payload: Uploaded XML files could execute same-origin JavaScript

Source: GitHub Advisory Database (reviewed) High CVE-2026-105868

Packages

EcosystemPackageAffectedFixed in
npm payload < 3.90.0 3.90.0
npm payload >= 4.0.0-canary.0, < 4.0.0-canary.34 4.0.0-canary.34

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. You are affected if: - You accept XML uploads (accepted by default). ### Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds Disallow XML/XSL uploads.

References

External links from the advisory. They lead to third-party sites.