GHSA-v49j-62m6-pgrr

Payload: SQL Injection in SQLite and Postgres

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-105845

Packages

Ecosystem	Package	Affected	Fixed in
npm	payload	>= 3.0.0, < 3.88.0	3.88.0
npm	payload	>= 4.0.0-canary.0, < 4.0.0-canary.27	4.0.0-canary.27

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB (`@payloadcms/mongodb`). ### Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`. ### Workarounds Upgrading to a patched version is recommended. Until you can upgrade, restrict untrusted users from supplying dynamic query filters or join parameters and limit read access to affected collections.

References

External links from the advisory. They lead to third-party sites.