lee1981 (@lee1981b) on X

What it is

CVE-2026-105844, prototype pollution (CWE-1321) in @payloadcms/plugin-import-export, scored CVSS v4.0 9.3 Critical by the vendor/GitHub CNA: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Tracked upstream as GHSA-qf28-8hc6-vwrp, reported by iamnoooob.

How it works

The plugin accepts dot-separated field paths for data selection; some path segments touch JavaScript prototype relationships. Unsafe handling lets untrusted field selection influence application object state beyond the intended export/import operation. The patch guards against segments exactly equal to __proto__, constructor, and prototype; creates intermediate objects with null prototypes; checks property ownership; and validates array bounds in the nested-value helper used by export preview. The vendor confirms potential RCE but no downstream exploitation gadget or universal execution chain is documented — that remains case-specific.

Preconditions / Affected

• Plugin must be enabled and its routes reachable; a lockfile entry alone doesn't establish this.
• Stable: >=3.0.0, <3.88.0. Canary: >=4.0.0-canary.0, <4.0.0-canary.27.
• Default routes (changeable via slug/prefix): POST /api/exports/export-preview, POST /api/exports/download.
• No authentication or prior privileges required; network access and low attack complexity.

What to do

Upgrade aligned Payload packages per train:

• Stable to >=3.88.0 (latest observed: 3.90.2)
• Canary to >=4.0.0-canary.27

While upgrading, the vendor recommends disabling the plugin or restricting endpoint access — verify this across custom slugs, prefixes, direct listeners, and proxy routes; hiding a menu item or protecting only admin login does not block the handlers.

Inventory check (owner-run, not install):

npm ls --all --json payload @payloadcms/plugin-import-export > payload-package-tree.json

Detection vocabulary for request triage: field paths containing __proto__, constructor, or prototype segments at confirmed import-export routes are leads, not proof — a 200/400 status or matched token needs correlation with unexplained execution, writes, or egress on the same asset/window before being treated as exploitation.

Caveats

• No CISA KEV match found in the 2026.10.04 catalogue; FIRST EPSS returned no score/percentile (not the same as 0%).
• No standalone PoC or confirmed field exploitation verified in the material reviewed.
• "Invalid field path" error strings indicate the patch is active, not that exploitation occurred or didn't.
• A quiet/no-match SOC hunt reflects gaps in logging coverage (access-only logs often omit fields) — it is not a clean-system certificate.