CVE-2026-105862: Payload Package SVG Upload Sanitization Bypass Vulnerability
Summary
CVE-2026-105862: Payload: Bypassed sanitization of user uploaded SVGs. Affects payload across 2 version ranges.
< 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Payload package is a popular open-source framework for building content management systems and applications using Node.js. It allows developers to create customizable and extensible applications with ease. However, it has a vulnerability that allows malicious users to upload SVG files that can execute arbitrary JavaScript, leading to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the failure to properly sanitize user-uploaded SVG files. An attacker can upload a malicious SVG file that contains JavaScript code. When a user downloads and opens this file, the JavaScript executes in the user's browser, potentially leading to data theft, session hijacking, or other malicious actions. This vulnerability is classified under CWE-434 (Unrestricted File Upload) and CWE-79 (Improper Neutralization of Input During Web Page Generation).
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.90.03.90.0npm install payload@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install payload@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can disallow SVG uploads entirely or serve uploaded SVGs as downloads with the following HTTP header: Content-Disposition: attachment. Additionally, implement a strict Content Security Policy (CSP) to mitigate risks. Example of setting the header in an Express.js application:
app.get('/download', function(req, res) {
res.setHeader('Content-Disposition', 'attachment; filename="file.svg"');
res.sendFile('/path/to/file.svg');
});
Conclusion
The Payload package has a significant vulnerability that allows for the upload of malicious SVG files, leading to potential XSS attacks. Users are strongly advised to upgrade to the patched versions to secure their applications. Temporary workarounds can help mitigate risks until the upgrade is completed.
See every vulnerability recorded for payload →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can lead to cross-site scripting (XSS) attacks, allowing attackers to execute arbitrary JavaScript in users' browsers.
Yes, you can disallow SVG uploads or serve them as downloads with a strict Content Security Policy to reduce exposure.
Versions 3.90.0 and 4.0.0-canary.34 or later are patched and safe to use.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
