{"id":"CVE-2026-105856","aliases":["CVE-2026-63316","GHSA-pj7x-6wpf-pgvp"],"url":"https://o3.security/vulnerability/CVE-2026-105856","summary":"Payload: SQL injection in SQLite/Postgres","details":"### Impact\n\nAn attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres.\n\n#### You are affected if:\n\n- You use `@payloadcms/db-sqlite` or `@payloadcms/db-d1-sqlite`.\n- You use `@payloadcms/db-postgres` or `@payloadcms/db-vercel-postgres` `< 3.73.0`.\n- A readable collection has a `json` field, or a` blocks` field with `blocksAsJSON: true`.\n- The attacker has read plus create or update access on it.\n\n#### You are not affected if:\n- You have no `json or `blocksAsJSON` fields. `richText` is not affected.\n- You run a patched version.\n\n### Patches\n\nThe patched version sanitizes the query input to prevent injection.\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.","published":"2026-10-06T16:23:58.643Z","modified":"2026-10-16T02:47:41.916940539Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@payloadcms/db-sqlite","fixedVersion":"3.90.0"},{"ecosystem":"npm","name":"@payloadcms/db-d1-sqlite","fixedVersion":"3.90.0"},{"ecosystem":"npm","name":"@payloadcms/db-postgres","fixedVersion":"3.73.0"},{"ecosystem":"npm","name":"@payloadcms/db-vercel-postgres","fixedVersion":"3.73.0"},{"ecosystem":"npm","name":"@payloadcms/db-sqlite","fixedVersion":"4.0.0-canary.34"},{"ecosystem":"npm","name":"@payloadcms/db-d1-sqlite","fixedVersion":"4.0.0-canary.34"}],"fix":{"url":"https://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc","label":"payloadcms/payload@03b78c7"},"references":[{"type":"WEB","url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105856.json"},{"type":"ADVISORY","url":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105856"},{"type":"FIX","url":"https://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc"},{"type":"PACKAGE","url":"https://github.com/payloadcms/payload"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-16T02:47:41.916940539Z"}}