payload (npm)
Advisories
47
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.0.0-canary.34 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install payload@4.0.0-canary.34yarn
yarn add payload@4.0.0-canary.34pnpm
pnpm add payload@4.0.0-canary.34Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript |
High EPSS 0.17% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript |
High EPSS 0.17% |
< 3.90.0 | 3.90.0 |
| GHSA-v5gf-vpjc-pc7w Payload: Unauthenticated account-lockout denial of service |
High EPSS 0.37% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-v5gf-vpjc-pc7w Payload: Unauthenticated account-lockout denial of service |
High EPSS 0.37% |
< 3.90.0 | 3.90.0 |
| GHSA-p223-2wr2-j562 Payload: Incomplete validation during the upload file lifecycle |
High EPSS 0.38% |
< 3.90.0 | 3.90.0 |
| GHSA-p223-2wr2-j562 Payload: Incomplete validation during the upload file lifecycle |
High EPSS 0.38% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue |
Critical EPSS 0.38% |
>= 3.0.0, < 3.90.0 | 3.90.0 |
| GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue |
Critical EPSS 0.38% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-2pwp-2369-8fg3 Payload: Bypassed sanitization of user uploaded SVGs |
High EPSS 0.27% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-2pwp-2369-8fg3 Payload: Bypassed sanitization of user uploaded SVGs |
High EPSS 0.27% |
< 3.90.0 | 3.90.0 |
| GHSA-pj5h-5q6c-3pfx Payload external upload trust validation issue |
High EPSS 0.13% |
>= 3.0.0, < 3.90.0 | 3.90.0 |
| GHSA-pj5h-5q6c-3pfx Payload external upload trust validation issue |
High EPSS 0.13% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents |
Critical EPSS 0.35% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents |
Critical EPSS 0.35% |
< 3.90.0 | 3.90.0 |
| GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register |
High EPSS 0.47% |
< 3.90.0 | 3.90.0 |
| GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register |
High EPSS 0.47% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-fx49-4h83-wjv9 Payload didn't enforce field-level password update restrictions |
High EPSS 0.25% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-fx49-4h83-wjv9 Payload didn't enforce field-level password update restrictions |
High EPSS 0.25% |
< 3.90.0 | 3.90.0 |
| GHSA-2g7p-5934-q4w7 Payload: ReDoS in Multipart Content-Type Validation |
High EPSS 0.35% |
>= 3.0.0, < 3.90.0 | 3.90.0 |
| GHSA-2g7p-5934-q4w7 Payload: ReDoS in Multipart Content-Type Validation |
High EPSS 0.35% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-238x-w2j9-gwwr Payload vulnerable to API key disclosure through ordinary document reads |
High EPSS 0.30% |
>= 3.0.0, < 3.90.0 | 3.90.0 |
| GHSA-238x-w2j9-gwwr Payload vulnerable to API key disclosure through ordinary document reads |
High EPSS 0.30% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-7c34-32v3-j575 Payload relationship-query authorization bypass |
High EPSS 0.27% |
< 3.90.0 | 3.90.0 |
| GHSA-7c34-32v3-j575 Payload relationship-query authorization bypass |
High EPSS 0.27% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-xgv3-crq2-6f69 Payload: Token refresh and password reset responses may expose restricted user fields |
Medium EPSS 0.26% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-xgv3-crq2-6f69 Payload: Token refresh and password reset responses may expose restricted user fields |
Medium EPSS 0.26% |
>= 3.0.0, < 3.90.0 | 3.90.0 |
| GHSA-v49j-62m6-pgrr Payload: SQL Injection in SQLite and Postgres |
Critical EPSS 0.38% |
>= 3.0.0, < 3.88.0 | 3.88.0 |
| GHSA-v49j-62m6-pgrr Payload: SQL Injection in SQLite and Postgres |
Critical EPSS 0.38% |
>= 4.0.0-canary.0, < 4.0.0-canary.27 | 4.0.0-canary.27 |
| GHSA-w84c-53h3-mc2g Payload: Untrusted redirect URL parameter exploit |
Medium EPSS 0.22% |
>= 3.40.0, < 3.88.0 | 3.88.0 |
| GHSA-w84c-53h3-mc2g Payload: Untrusted redirect URL parameter exploit |
Medium EPSS 0.22% |
>= 4.0.0-canary.0, < 4.0.0-canary.27 | 4.0.0-canary.27 |
| GHSA-fpww-c55p-cjv6 Payload: Polymorphic join queries could disclose hidden fields |
Medium EPSS 0.24% |
>= 3.0.0, < 3.90.0 | 3.90.0 |
| GHSA-fpww-c55p-cjv6 Payload: Polymorphic join queries could disclose hidden fields |
Medium EPSS 0.24% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-q6mq-ch85-c8mm Payload: Password hashes use insufficient PBKDF2 iterations |
Medium EPSS 0.08% |
>= 3.0.0, < 3.90.0 | 3.90.0 |
| GHSA-q6mq-ch85-c8mm Payload: Password hashes use insufficient PBKDF2 iterations |
Medium EPSS 0.08% |
>= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| GHSA-9g87-32v6-3c2r Payload: Sort queries could expose protected field information |
Medium EPSS 0.28% |
< 3.88.0 | 3.88.0 |
| GHSA-9g87-32v6-3c2r Payload: Sort queries could expose protected field information |
Medium EPSS 0.28% |
>= 4.0.0-canary.0, < 4.0.0-canary.27 | 4.0.0-canary.27 |
| GHSA-jg8r-5jh2-v2xj Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts |
Medium EPSS 0.36% |
<= 3.88.0 | No fix yet |
| GHSA-p6mr-xf3r-ghq4 Payload has a CSRF Protection Bypass in Authentication Flow |
Medium EPSS 0.13% |
< 3.79.1 | 3.79.1 |
| GHSA-7xxh-373w-35vg Payload has an SQL Injection via Query Handling |
High EPSS 0.32% |
< 3.79.1 | 3.79.1 |
| GHSA-6r7f-q7f5-wpx8 Payload has Authenticated SSRF via Upload Functionality |
High EPSS 0.31% |
< 3.79.1 | 3.79.1 |
| GHSA-hp5w-3hxx-vmwf Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery |
Critical EPSS 0.31% |
< 3.79.1 | 3.79.1 |
| GHSA-hhfx-5x8j-f5f6 Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads |
Medium EPSS 0.34% |
< 3.75.0 | 3.75.0 |
| GHSA-jq29-r496-r955 payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) |
Medium EPSS 0.22% |
< 3.74.0 | 3.74.0 |
| GHSA-26rv-h2hf-3fw4 Payload's SQLite adapter Session Fixation vulnerability |
Medium EPSS 0.43% |
< 3.44.0 | 3.44.0 |
| GHSA-5v66-m237-hwf7 Payload does not invalidate JWTs after log out |
Medium EPSS 0.41% |
< 3.44.0 | 3.44.0 |
| GHSA-35jj-vqcf-f2jf Hidden fields can be leaked on readable collections in Payload |
Medium EPSS 0.63% |
< 1.7.0 | 1.7.0 |
| GHSA-w8xh-93qh-35vw Unrestricted Upload of File with Dangerous Type in Payload |
Critical EPSS 2.31% |
< 0.15.1 | 0.15.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor