Disclosure summary
### Impact An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code (RCE). Applications that do not use `@payloadcms/plugin-import-export` are not affected. ### Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27.` ### Workarounds Upgrading is recommended. Until then, disable the Import Export plugin or restrict access to its endpoints.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-qf28-8hc6-vwrp
Open original source · Updated Oct 06, 2026
Payload: Prototype pollution in Payload Import Export plugin
Source severity: CRITICAL / 9.3
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | @payloadcms/plugin-import-export | >= 3.0.0, < 3.88.0 | 3.88.0 |
| npm | @payloadcms/plugin-import-export | >= 4.0.0-canary.0, < 4.0.0-canary.27 | 4.0.0-canary.27 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-10-06T12:09:23-04:00
MODIFIED 2026-10-06T12:09:24-04:00
INGESTED 2026-10-08T12:05:11-04:00