Payload: Prototype pollution in Payload Import Export plugin

CRITICAL 9.3CVE-2026-105844 · GHSA-qf28-8hc6-vwrp · Published 06/10/2026 · updated 09/10/2026

In short

CVE-2026-105844 is a CRITICAL (CVSS 9.3) vulnerability affecting @payloadcms/plugin-import-export.
Chance of exploitation in the next 30 days (EPSS): 0.71%, higher than 53.6% of all vulnerabilities.
Fix: update to 3.88.0, 4.0.0-canary.27 or later.

Package	Affected versions	Patched versions
@payloadcms/plugin-import-export npm	`≥ 3.0.0, < 3.88.0≥ 4.0.0-canary.0, < 4.0.0-canary.27`	`3.88.04.0.0-canary.27`

Description

Impact

An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE).

Applications that do not use @payloadcms/plugin-import-export are not affected.

Patches

Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.

Workarounds

Upgrading is recommended. Until then, disable the Import Export plugin or restrict access to its endpoints.

NVD description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

References

payloadcms/payload security advisory · WEB
payloadcms/payload commit a742140 · WEB
payloadcms/payload · PACKAGE
payloadcms/payload release v3.88.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

@payloadcms/plugin-import-export

npm

≥ 3.0.0, < 3.88.0≥ 4.0.0-canary.0, < 4.0.0-canary.27

3.88.04.0.0-canary.27