{"uuid": "db6dd8a6-e6c7-4494-865d-7eda8c74e6a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105844", "type": "seen", "source": "https://gist.github.com/alon710/3583dedc8f73c0d4a0175e520c5ec25d", "content": "# CVE-2026-105844: CVE-2026-105844: Remote Code Execution via Prototype Pollution in @payloadcms/plugin-import-export\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105844\n\n## Summary\nA critical prototype pollution vulnerability in the import-export plugin of Payload CMS allows unauthenticated remote attackers to bypass access controls and achieve remote code execution.\n\n## TL;DR\nUnauthenticated remote attackers can pollute the global object prototype in Payload CMS to bypass access controls and execute arbitrary code on the server.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.3 (Critical)\n- **EPSS Score**: N/A\n- **Impact**: Remote Code Execution (RCE) / Privilege Escalation\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Payload CMS instances running @payloadcms/plugin-import-export < 3.88.0\n- **Payload CMS (@payloadcms/plugin-import-export)**: >= 3.0.0, < 3.88.0 (Fixed in: `3.88.0`)\n- **Payload CMS (canary)**: < 4.0.0-canary.27 (Fixed in: `4.0.0-canary.27`)\n\n## Mitigation\n\n- Upgrade to Payload CMS v3.88.0 or 4.0.0-canary.27\n- Deploy Web Application Firewall (WAF) signatures to block request payloads containing __proto__ or constructor paths\n- Restrict network access to export preview endpoints if they are not strictly required for external operations\n\n**Remediation Steps:**\n1. Run 'npm install payload@3.88.0 @payloadcms/plugin-import-export@3.88.0' to upgrade the monorepo.\n2. Verify the installation using 'npm list payload @payloadcms/plugin-import-export'.\n3. Restart the node application to apply the code changes in-memory.\n\n## References\n\n- [GHSA-qf28-8hc6-vwrp Advisory](https://github.com/payloadcms/payload/security/advisories/GHSA-qf28-8hc6-vwrp)\n- [NVD CVE-2026-105844](https://nvd.nist.gov/vuln/detail/CVE-2026-105844)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105844) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T03:30:29.000000Z"}