Open-source package vulnerability · npm
CVE-2026-105857: Payload Form Builder has an RCE issue
criticalCVSS 3.1 10.0GHSA-r488-j9vj-wx3q
Impact A vulnerability in @payloadcms/plugin-form-builder in versions = 3.90.0 or = 4.0.0-canary.34.
Published Oct 7, 2026
Affected packages
@payloadcms/plugin-form-builder
- Ecosystem
- npm
- Affected
- < 3.90.0
- Fixed in
- 3.90.0
- Check
npm ls @payloadcms/plugin-form-builder
@payloadcms/plugin-form-builder
- Ecosystem
- npm
- Affected
- >= 4.0.0-canary.0, < 4.0.0-canary.34
- Fixed in
- 4.0.0-canary.34
- Check
npm ls @payloadcms/plugin-form-builder
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
A vulnerability in @payloadcms/plugin-form-builder in versions < 3.90.0 allow submissions which could be crafted to execute remote code on the server.
You are affected if:
- You are using
@payloadcms/plugin-form-builder
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Credited to Zerotistic.
References
- https://github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q
- https://nvd.nist.gov/vuln/detail/CVE-2026-105857
- https://github.com/payloadcms/payload/commit/333b82b9f3e685fed6826c2e3270da79df8336c6
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
- https://github.com/advisories/GHSA-r488-j9vj-wx3q
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology