| Package | Affected versions | Patched versions |
|---|---|---|
| payload | ≥ 3.0.0, < 3.88.0≥ 4.0.0-canary.0, < 4.0.0-canary.27 | 3.88.04.0.0-canary.27 |
A user can submit a request that exploits a SQL Injection vulnerability in Payload.
You are affected if:
You are not affected if you use MongoDB (@payloadcms/mongodb).
Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.
Upgrading to a patched version is recommended. Until you can upgrade, restrict untrusted users from supplying dynamic query filters or join parameters and limit read access to affected collections.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free