Résumé
Payload: Prototype pollution in Payload Import Export plugin
Détails de l’avis
Impact
An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE).
Applications that do not use @payloadcms/plugin-import-export are not affected.
Patches
Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.
Workarounds
Upgrading is recommended. Until then, disable the Import Export plugin or restrict access to its endpoints.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-107301
msgpack5: Partial options disable prototype protection
- HIGHCVE-2026-105858
Payload: Remote Code Execution through first-register
- CRITICALCVE-2026-105857
Payload Form Builder has an RCE issue
- HIGHCVE-2026-104852
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
- CRITICALCVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
- CRITICALCVE-2026-104849
Tinypool: Prototype Pollution Gadget to RCE in run() options