Payload has an SQL Injection via Query Handling

Description

Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.79.1
• Patched version(s): 3.79.1

References

• GHSA-7xxh-373w-35vg
• CVE-2026-34747
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Drizzle ORM has SQL injection via improperly escaped SQL identifiers - CVE-2026-39356
• @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading - CVE-2026-41640
• Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that - CVE-2026-33468
• OneUptime ClickHouse SQL Injection via Aggregate Query Parameters - CVE-2026-32306

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

payload