CVE-2026-105844

GitHubCritical, npm

Payload: Prototype pollution in Payload Import Export plugin

An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE).

No known exploitation
Severity: Critical, CVSS 9.3 (v4.0)
EPSS: 0.52% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages: @payloadcms/plugin-import-export (npm) >= 3.0.0, < 3.88.0, fixed in 3.88.0 · GHSA-qf28-8hc6-vwrp
@payloadcms/plugin-import-export (npm) >= 4.0.0-canary.0, < 4.0.0-canary.27, fixed in 4.0.0-canary.27 · GHSA-qf28-8hc6-vwrp