CVE-2026-105844: Payload: Prototype pollution in Payload Import Export plugin

October 6, 2026

An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE).

Applications that do not use @payloadcms/plugin-import-export are not affected.

References

github.com/advisories/GHSA-qf28-8hc6-vwrp
github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a
github.com/payloadcms/payload/releases/tag/v3.88.0
github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp
nvd.nist.gov/vuln/detail/CVE-2026-105844

Code Behaviors & Features

Detect and mitigate CVE-2026-105844 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →