Plugin Import Export
Monthly
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker submit prototype-sensitive field paths to the plugin's endpoints, corrupting object prototypes and triggering unintended application behavior that can escalate to remote code execution. The flaw affects Payload 3.0.0 through versions before 3.88.0 and 4.0.0-canary.0 through versions before 4.0.0-canary.27, but only when the Import Export plugin is installed and enabled - sites without that plugin are unaffected. No public exploit code has been identified at time of analysis, and exploitation is gated by the presence of a reachable prototype-pollution gadget in the target application, so real-world impact is conditional even though the vendor advisory and a 9.3 CVSS 4.0 score (independent assessment: CVSS 3.1 8.1-range with AC:H) both flag it as high severity.
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker submit prototype-sensitive field paths to the plugin's endpoints, corrupting object prototypes and triggering unintended application behavior that can escalate to remote code execution. The flaw affects Payload 3.0.0 through versions before 3.88.0 and 4.0.0-canary.0 through versions before 4.0.0-canary.27, but only when the Import Export plugin is installed and enabled - sites without that plugin are unaffected. No public exploit code has been identified at time of analysis, and exploitation is gated by the presence of a reachable prototype-pollution gadget in the target application, so real-world impact is conditional even though the vendor advisory and a 9.3 CVSS 4.0 score (independent assessment: CVSS 3.1 8.1-range with AC:H) both flag it as high severity.