| Package | Affected versions | Patched versions |
|---|---|---|
| payload | < 3.73.0 | 3.73.0 |
| @payloadcms/drizzle | < 3.73.0 | 3.73.0 |
When querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL Injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking.
Users are affected if ALL of these are true:
@payloadcms/drizzle as dependency):
@payloadcms/db-postgres@payloadcms/db-vercel-postgres@payloadcms/db-sqlite@payloadcms/db-d1-sqlitetype: 'json' or type: 'richText' field where access.read returns anything other than false (true or Where constraint)Users are NOT affected if:
@payloadcms/db-mongodbaccess: { read: () => false }Upgrade to Payload v3.73.0 or later.
If a project cannot upgrade immediately, add access: { read: () => false } to all JSON and richText fields as a temporary mitigation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free