Payload: Uploaded XML files could execute same-origin JavaScript

Description

Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file.

You are affected if:

• You accept XML uploads (accepted by default).

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34

  < 3.90.0**

• Patched version(s): **4.0.0-canary.34

  3.90.0**

References

• GHSA-9qpg-3cf8-w33x
• CVE-2026-105868
• CWE-434
• CAPEC-310