GHSA-97rh-rhh2-7vjvHighCVSS 8.1
Payload: Remote Code Execution through first-register
🔗 CVE IDs covered (1)
📋 Description
Impact
A crafted request to the public first-register operation can be used to perform a RCE exploit.
You are affected if:
- You use local auth strategy and your application remains without an initial user created
Patches
In the patched version data submission to create first user is properly sanitized.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
🎯 Affected products2
- npm/payload:< 3.90.0
- npm/payload:>= 4.0.0-canary.0, < 4.0.0-canary.34
🔗 References (5)
- https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv
- https://nvd.nist.gov/vuln/detail/CVE-2026-105858
- https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
- https://github.com/advisories/GHSA-97rh-rhh2-7vjv