@frogbotai/db-d1-sqlite (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-63316 via @payloadcms/db-d1-sqlite (>=3.85.1, <=3.88.0)

@payloadcms/db-d1-sqlite NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-63316 Source advisory: SNYK:JS-PAYLOADCMSDBD1SQLITE-20936945...

SQL Injection

Overview @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticate...

@frogbotai/db-d1-sqlite (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105856 via @payloadcms/db-d1-sqlite (>=3.85.1, <=3.88.0)

@payloadcms/db-d1-sqlite NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105856 Source advisory: SNYK:JS-PAYLOADCMSDBD1SQLITE-20936901...

@frogbotai/db-d1-sqlite (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105856 +1 more via @payloadcms/db-d1-sqlite (>=3.85.1, <=3.88.0)

@payloadcms/db-d1-sqlite NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105856, CVE-2026-63316 Source advisory: OSV:GHSA-PJ7X-6WPF-PGVP...

@frogbotai/db-d1-sqlite (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105856 via @payloadcms/db-d1-sqlite (>=3.85.1, <=3.88.0)

@payloadcms/db-d1-sqlite NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105856 Source advisory: GHSA-PJ7X-6WPF-PGVP...

SQL Injection

Overview @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are...

Payload: SQL injection in SQLite/Postgres

Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. You are affected if: - You use @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite. -...

@payloadcms/db-d1-sqlite (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/db-postgres (>=4.0.0-canary.0, <=4.0.0-canary.33) +2 more potentially affected by CVE-2026-105856 via @payloadcms/drizzle (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/drizzle NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105856 Source advisory: MEND:CVE-2026-105856...

@frogbotai/db-d1-sqlite (>=0.0.1, <=0.23.0) potentially affected by CVE-2026-105856 via @payloadcms/db-d1-sqlite (>=3.85.1, <=3.88.0)

@payloadcms/db-d1-sqlite NPM version =3.85.1, =0.0.1, =0.23.0 Source cves: CVE-2026-105856 Source advisory: MEND:CVE-2026-105856...

@payloadcms/db-d1-sqlite (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/db-postgres (>=4.0.0-canary.0, <=4.0.0-canary.33) +2 more potentially affected by CVE-2026-105852 via @payloadcms/drizzle (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/drizzle NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105852 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-20571386...