Payload has an SQL Injection via Query Handling

Description

Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.79.1
• Patched version(s): 3.79.1

References

• GHSA-7xxh-373w-35vg
• CVE-2026-34747
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server has a SQL injection via query field name when using PostgreSQL - CVE-2026-32234
• @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading - CVE-2026-41640
• Drizzle ORM has SQL injection via improperly escaped SQL identifiers - CVE-2026-39356
• Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that - CVE-2026-33468

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

payload