CVE-2026-105845

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.87.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.26

Description An untrusted user can trigger SQL injection in the SQLite and Postgres adapters by submitting requests that query readable collections through dynamic filters or joins. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update Payload versions 3.0.0 through 3.87.9 to version 3.88.0 or newer. Update Payload versions 4.0.0-canary.0 through 4.0.0-canary.26 to version 4.0.0-canary.27 or newer. Restrict untrusted users from supplying dynamic query filters or join parameters and limit read access to affected collections.