{"id":"CVE-2026-63316","aliases":["CVE-2026-105856","GHSA-pj7x-6wpf-pgvp"],"url":"https://o3.security/vulnerability/CVE-2026-63316","summary":"SQL Injection in Payload CMS","details":"### Impact\n\nAn attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres.\n\n#### You are affected if:\n\n- You use `@payloadcms/db-sqlite` or `@payloadcms/db-d1-sqlite`.\n- You use `@payloadcms/db-postgres` or `@payloadcms/db-vercel-postgres` `< 3.73.0`.\n- A readable collection has a `json` field, or a` blocks` field with `blocksAsJSON: true`.\n- The attacker has read plus create or update access on it.\n\n#### You are not affected if:\n- You have no `json or `blocksAsJSON` fields. `richText` is not affected.\n- You run a patched version.\n\n### Patches\n\nThe patched version sanitizes the query input to prevent injection.\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.","published":"2026-10-13T11:05:09.403Z","modified":"2026-10-17T02:30:55.582276069Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@payloadcms/db-sqlite","fixedVersion":"3.90.0"},{"ecosystem":"npm","name":"@payloadcms/db-d1-sqlite","fixedVersion":"3.90.0"},{"ecosystem":"npm","name":"@payloadcms/db-postgres","fixedVersion":"3.73.0"},{"ecosystem":"npm","name":"@payloadcms/db-vercel-postgres","fixedVersion":"3.73.0"},{"ecosystem":"npm","name":"@payloadcms/db-sqlite","fixedVersion":"4.0.0-canary.34"},{"ecosystem":"npm","name":"@payloadcms/db-d1-sqlite","fixedVersion":"4.0.0-canary.34"}],"fix":{"url":"https://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc","label":"payloadcms/payload@03b78c7"},"references":[{"type":"ADVISORY","url":"https://cert.pl/posts/2026/10/CVE-2026-63316"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63316.json"},{"type":"ADVISORY","url":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63316"},{"type":"PACKAGE","url":"https://github.com/payloadcms/payload"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105856"},{"type":"WEB","url":"https://github.com/payloadcms/payload/commit/03b78c7e0901d19c67f07bdf6396a276010adbcc"},{"type":"WEB","url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-17T02:30:55.582276069Z"}}