CVE-2026-105844: Payload: Prototype pollution in Payload Import Export plugin

The advisory classes the flaw as prototype pollution (CWE-1321): input that names object attributes to set or update can change the prototype of base objects in the Node process. It says an unauthenticated user can cause unintended application behavior and submit and execute code remotely when the plugin is enabled. It does not describe the exact input or gadget chain, and the sources do not say which endpoint takes the polluted data.

The attacker needs only network access to a Payload application that has the plugin enabled. No account and no user interaction are needed, which is why the CVSS 4.0 vector reads network, low complexity, no privileges and high impact on confidentiality, integrity and availability. A successful exploit gives code execution inside the Payload server process, so the attacker can reach its database credentials, secrets in the environment, and stored content.

Applications that do not use @payloadcms/plugin-import-export are not affected. The commit linked to the advisory also changes multipart parsing and query validation, so it appears to bundle several hardening fixes. Do not infer the exact root cause from it.

The npm package @payloadcms/plugin-import-export in two ranges: 3.0.0 up to but not including 3.88.0, and 4.0.0-canary.0 up to but not including 4.0.0-canary.27. Only applications that install and enable the plugin are exposed.

npm ls @payloadcms/plugin-import-export

Also check the plugins array in your Payload config for importExportPlugin. The advisory tells users to upgrade the Payload packages to the patched versions.

Upgrade Payload packages to 3.88.0 or later, or to 4.0.0-canary.27 or later on the v4 canary line:

npm install @payloadcms/[email protected]

Keep the other payload and @payloadcms/* packages on matching versions. Until you can upgrade, the advisory says to disable the Import Export plugin or restrict access to its endpoints, for example by blocking them at the reverse proxy.

Check web and proxy logs for unauthenticated requests to the plugin's import and export endpoints, especially with JSON bodies that contain __proto__, constructor or prototype keys. Look for unexpected child processes, new files or outbound connections from the Node process running Payload. The advisory names no log line, so treat an unauthenticated hit on those endpoints as suspect and rotate secrets if you cannot rule out exploitation.

Impact

An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE).

Applications that do not use @payloadcms/plugin-import-export are not affected.

Patches

Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.

Workarounds

Upgrading is recommended. Until then, disable the Import Export plugin or restrict access to its endpoints.