SQL Injection

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to SQL Injection via the endpoints accepting dynamic query for Collections. An attacker can access sensitive information or modify data by...

@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

Impact When querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL Injection attacks. An unauthenticated attacker could extract sensitive data emails, password reset tokens and achieve full account takeover without password cracking. Users...

SQL Injection

Overview @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user accoun...

SQL Injection

Overview @payloadcms/db-postgres is a The officially supported Postgres database adapter for Payload Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user accounts...

SQL Injection

Overview @payloadcms/db-vercel-postgres is a Vercel Postgres adapter for Payload Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user accounts by injecting crafte...

SQL Injection

Overview @payloadcms/drizzle is an A library of shared functions used by different payload database adapters Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection when querying JSON or richText fields. An attacker can extract sensitive information and gain unauthorized access to user accounts by injecting crafted SQL statements. Note: This is only exploitable if a Drizzle-based...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +23 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0, <=3.72.0-internal.3e70d4c)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDRIZZLE-15240185...

@adenta/cms (>=0.0.6, <=1.1.1-0), @ainsleydev/payload-helper (>=0.0.6, <=0.1.2) +23 more potentially affected by CVE-2026-25544 via @payloadcms/drizzle (>=3.0.0, <=3.72.0-internal.3e70d4c)

@payloadcms/drizzle NPM version =3.0.0, =0.0.6, =0.0.6, =3.22.1, =3.37.0, =1.0.0, =3.53.0, =3.61.1-2, =3.50.0-internal.ca62628, =3.0.0-beta.74, =3.0.0-beta.74, =3.0.0-beta.116, =1.0.1, =1.0.2 and more Source cves: CVE-2026-25544 Source advisory: OSV:GHSA-XX6W-JXG9-2WH8...

GHSA-XX6W-JXG9-2WH8 @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

Impact When querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL Injection attacks. An unauthenticated attacker could extract sensitive data emails, password reset tokens and achieve full account takeover without password cracking. Users...

PT-2026-6650

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.73.0 Description Payload is a free and open source headless content management system. Prior to version 3.73.0, user input was directly embedded into SQL queries without proper escaping when querying JSON or richTex...

EUVD-2025-199292

Malicious code in @silgi/drizzle npm...

MAL-2025-191312 Malicious code in @silgi/drizzle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c2e7d01c383c77ebeddc3e05fac0d15335e412587dc2581a75f3406fdbf8fa The package @silgi/drizzle was found to contain malicious code. Source: ghsa-malware e8e9c9c9355daf84cb6c98baa093fe99abde3b51f58854ac5d4934752d55a9a3...

Malicious code in @silgi/drizzle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c2e7d01c383c77ebeddc3e05fac0d15335e412587dc2581a75f3406fdbf8fa The package @silgi/drizzle was found to contain malicious code. Source: ghsa-malware e8e9c9c9355daf84cb6c98baa093fe99abde3b51f58854ac5d4934752d55a9a3...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

MAL-2025-44075 Malicious code in drizzle_wa1uv_oa7e7_yew (npm)

The package drizzlewa1uvoa7e7yew was found to contain malicious code...

MAL-2025-18812 Malicious code in drizzle_5f87n_ganf3_verdant (npm)

The package drizzle5f87nganf3verdant was found to contain malicious code...

MAL-2025-9575 Malicious code in @tuan149/api-drizzle (npm)

The package @tuan149/api-drizzle was found to contain malicious code...

MAL-2025-18813 Malicious code in drizzle_kn5qz_3z98a_kestrel (npm)

The package drizzlekn5qz3z98akestrel was found to contain malicious code...

Malicious code in shopify-app-session-storage-drizzle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85a95ee44e756deede8f29d57f2f661bfad35e584127979455d61c95920d1c26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...