GHSA-97rh-rhh2-7vjv: Code Injection

Q: Which deployments are exposed to this issue?

Deployments using the local authentication strategy are affected only while no initial user has been created. The vulnerable path is the public first-register operation.

Q: Does exploitation require an existing account or user interaction?

No. The advisory describes exploitation through a crafted request to a public operation, and the vector lists no privileges or user interaction requirements. Exploitation has high attack complexity.

Q: What should teams do if they cannot upgrade immediately?

Create the initial user so the application no longer remains in the exposed first-registration state. Upgrade Payload packages as soon as possible to version 3.90.0 or later, or 4.0.0-canary.34 or later.

Q: How can we determine whether we were vulnerable?

Check whether the application uses local authentication and was left without an initial user. Also verify the installed Payload package version; patched releases are 3.90.0 and later, or 4.0.0-canary.34 and later.

Published Oct 7, 2026

Updated

Impact A crafted request to the public first-register operation can be used to perform a RCE exploit.

You are affected if:

- You use local auth strategy and your application remains without an initial user created

Patches

In the patched version data submission to create first user is properly sanitized.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Affected Software

2 affected componentsFixes available

npm/payload>=4.0.0-canary.0<4.0.0-canary.34

4.0.0-canary.34

npm/payload<3.90.0

3.90.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/payload to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Upgrade
Upgrade npm/payload to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34

Event History

Oct 7, 2026

Advisory Published

via GitHub·08:29 PM

Data Sourced

via GitHub·08:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the local authentication strategy are affected only while no initial user has been created. The vulnerable path is the public first-register operation.

Does exploitation require an existing account or user interaction?

No. The advisory describes exploitation through a crafted request to a public operation, and the vector lists no privileges or user interaction requirements. Exploitation has high attack complexity.

What should teams do if they cannot upgrade immediately?

Create the initial user so the application no longer remains in the exposed first-registration state. Upgrade Payload packages as soon as possible to version 3.90.0 or later, or 4.0.0-canary.34 or later.

How can we determine whether we were vulnerable?

Check whether the application uses local authentication and was left without an initial user. Also verify the installed Payload package version; patched releases are 3.90.0 and later, or 4.0.0-canary.34 and later.

GHSA-97rh-rhh2-7vjv: Code Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require an existing account or user interaction?

What should teams do if they cannot upgrade immediately?

How can we determine whether we were vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require an existing account or user interaction?

What should teams do if they cannot upgrade immediately?

How can we determine whether we were vulnerable?