| Package | Affected versions | Patched versions |
|---|---|---|
| payload | = 4.0.0< 3.90.0 | 3.90.0 |
| @payloadcms/db-d1-sqlite | ≥ 3.0.0, < 3.90.0≥ 4.0.0-canary.0, < 4.0.0-canary.34 | 3.90.04.0.0-canary.34 |
| @payloadcms/db-postgres | ≥ 3.0.0, < 3.73.0 | 3.73.0 |
| @payloadcms/db-sqlite | ≥ 3.0.0, < 3.90.0≥ 4.0.0-canary.0, < 4.0.0-canary.34 | 3.90.04.0.0-canary.34 |
| @payloadcms/db-vercel-postgres | ≥ 3.0.0, < 3.73.0 | 3.73.0 |
An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres.
@payloadcms/db-sqlite or @payloadcms/db-d1-sqlite.@payloadcms/db-postgres or @payloadcms/db-vercel-postgres < 3.73.0.json field, or a blocks field with blocksAsJSON: true.json or blocksAsJSONfields.richText` is not affected.The patched version sanitizes the query input to prevent injection.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free