{"id":"GHSA-7xxh-373w-35vg","revision":"5daeab43563b4c9d99d8c329914979c3","records":[{"revision":"5daeab43563b4c9d99d8c329914979c3","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-7xxh-373w-35vg","aliases":["CVE-2026-34747"],"title":"Payload has an SQL Injection via Query Handling","description":"### Impact\n\nCertain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.\n\n### Patches\n\nThis issue has been fixed in **v3.79.1** and later. Query input validation has been hardened.\n\nUpgrade to **v3.79.1 or later**.\n\n### Workarounds\n\nUntil developers can upgrade:\n\n- Limit access to endpoints that accept dynamic query inputs to trusted users only.  \n- Validate or sanitize input from untrusted clients before sending it to query endpoints.","state":0,"publishedAt":"2026-04-01T21:19:03+00:00","modifiedAt":"2026-04-06T17:03:39.306874+00:00","affected":[{"ecosystem":"npm","name":"payload","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.79.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg","https://nvd.nist.gov/vuln/detail/CVE-2026-34747","https://github.com/payloadcms/payload","https://github.com/payloadcms/payload/releases/tag/v3.79.1"],"sourceUrl":"https://github.com/advisories/GHSA-7xxh-373w-35vg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7xxh-373w-35vg","identifiers":["GHSA-7xxh-373w-35vg","CVE-2026-34747"]},"retained":false,"historicalAffected":[]}],"coverage":[]}