CVE-2026-105857

GitHubCritical, npm

Payload Form Builder has an RCE issue

A vulnerability in @payloadcms/plugin-form-builder in versions < 3.90.0 allow submissions which could be crafted to execute remote code on the server.

No known exploitation
Severity: Critical, CVSS 10.0 (v3.1)
EPSS: 0.43% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages: @payloadcms/plugin-form-builder (npm) < 3.90.0, fixed in 3.90.0 · GHSA-r488-j9vj-wx3q
@payloadcms/plugin-form-builder (npm) >= 4.0.0-canary.0, < 4.0.0-canary.34, fixed in 4.0.0-canary.34 · GHSA-r488-j9vj-wx3q