CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
A user can submit a request that exploits a SQL Injection vulnerability in Payload.
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.38% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- payload (npm) >= 3.0.0, < 3.88.0, fixed in 3.88.0 · GHSA-v49j-62m6-pgrr
- payload (npm) >= 4.0.0-canary.0, < 4.0.0-canary.27, fixed in 4.0.0-canary.27 · GHSA-v49j-62m6-pgrr