Description
When querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL Injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking.
Users are affected if ALL of these are true:
1.
Recommendation
Update the @payloadcms/drizzle package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.73.0
- Patched version(s): 3.73.0
References
Could your website be exposed too?
SmartScanner can check your website for @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
- Drizzle ORM has SQL injection via improperly escaped SQL identifiers - CVE-2026-39356
- @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading - CVE-2026-41640
- Payload has an SQL Injection via Query Handling - CVE-2026-34747
You might also like:
See something that needs correcting? Let us knowUpdated February 07, 2026