@payloadcms/next has Stored XSS in Admin Panel

Description

A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser.

Recommendation

Update the @payloadcms/next package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.78.0
• Patched version(s): 3.78.0

References

• GHSA-mmxc-95ch-2j7c
• CVE-2026-34748
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Apostrophe has stored XSS via javascript: URL in Image Widget Link - CVE-2026-45011
• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728
• Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode - CVE-2026-23634
• Payload's SQLite adapter Session Fixation vulnerability - @payloadcms/next - CVE-2025-4644

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@payloadcms/next