@payloadcms/next has Stored XSS in Admin Panel

Description

A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser.

Recommendation

Update the @payloadcms/next package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.78.0
• Patched version(s): 3.78.0

References

• GHSA-mmxc-95ch-2j7c
• CVE-2026-34748
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728
• Apostrophe has stored XSS via javascript: URL in Image Widget Link - CVE-2026-45011
• Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types - CVE-2026-31868
• Auth0 Next.js SDK has Improper Proxy Cache Lookup - CVE-2026-40155

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@payloadcms/next