CVE-2026-105845

{
  "etk_id": "ETK-2026-789",
  "cve_id": "CVE-2026-105845",
  "display_id": "CVE-2026-105845",
  "ghsa_id": "GHSA-v49j-62m6-pgrr",
  "euvd_id": "EUVD-2026-93471",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Payload SQLite and PostgreSQL adapters",
  "summary": "Payload releases before 3.88.0, and 4.0.0 canary releases before 4.0.0-canary.27, can expose SQL-backed collections to injection through query handling. An untrusted requester may alter database queries when they can access readable collections using dynamic filters or join parameters. Deployments using the MongoDB adapter are not affected.",
  "mitigation": "Upgrade Payload to 3.88.0 or later, or to 4.0.0-canary.27 or later for the canary line. Until upgraded, prevent untrusted users from providing dynamic filters or joins and restrict read access to affected collections.",
  "vendor": "npm",
  "product": "payload",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, < 3.88.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.88.0"
      ],
      "package_name": "payload",
      "purl": "pkg:npm/payload"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0-canary.0, < 4.0.0-canary.27"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "4.0.0-canary.27"
      ],
      "package_name": "payload",
      "purl": "pkg:npm/payload"
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0038,
  "epss_percentile": 0.307,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 23.758031733333333,
  "t0_at": "2026-10-06T15:58:51.232000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-06T17:46:01.421517+00:00",
      "days": 0.0744234897800926,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T15:58:51.232000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-06T15:58:51.232000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T15:58:51.232000+00:00",
      "url": "https://github.com/advisories/GHSA-v49j-62m6-pgrr"
    }
  }
}