Summary
Payload: SQL Injection in SQLite and Postgres
Advisory details
Impact
A user can submit a request that exploits a SQL Injection vulnerability in Payload.
You are affected if:
- You use an affected Payload version.
- Untrusted users can query readable collections using dynamic filters or joins.
You are not affected if you use MongoDB (@payloadcms/mongodb).
Patches
Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.
Workarounds
Upgrading to a patched version is recommended. Until you can upgrade, restrict untrusted users from supplying dynamic query filters or join parameters and limit read access to affected collections.
References
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
- HIGHCVE-2026-107384
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
- HIGHCVE-2026-107375
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
- MEDIUMCVE-2026-60090
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
- HIGHCVE-2026-105856
Payload: SQL injection in SQLite/Postgres
- HIGHCVE-2026-62251
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query