GHSA-r488-j9vj-wx3q: Code Injection
Impact
A vulnerability in @payloadcms/plugin-form-builder in versions < 3.90.0 allow submissions which could be crafted to execute remote code on the server.
You are affected if:
- You are using @payloadcms/plugin-form-builder
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@payloadcms/plugin-form-builderto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/@payloadcms/plugin-form-builderto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
@payloadcms/plugin-form-builderto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
@payloadcms/plugin-form-builderto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34
Event History
Frequently Asked Questions
Which deployments are affected?
Any deployment using @payloadcms/plugin-form-builder is affected if it is running a version earlier than 3.90.0. The advisory identifies upgrades to Payload packages at version 3.90.0 or later, or 4.0.0-canary.34 or later, as patched.
Does exploitation require an authenticated user or user interaction?
No. The provided vector indicates network-accessible exploitation with low attack complexity, no privileges required, and no user interaction required. Crafted form submissions can be used to execute code on the server.
What should be done to remediate the issue?
Upgrade the Payload packages to version 3.90.0 or later. For the canary release line, upgrade to 4.0.0-canary.34 or later.