CVE-2026-105868: Payload Package Vulnerability Allows Execution of Same-Origin JavaScript from Uploaded XML Files
Summary
CVE-2026-105868: Payload: Uploaded XML files could execute same-origin JavaScript. Affects payload across 2 version ranges.
< 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Payload package is a popular open-source framework used for building content management systems and applications. It allows developers to manage and upload various file types, including XML files. However, due to a vulnerability in its handling of XML uploads, there is a risk that malicious JavaScript can be executed when a logged-in user opens an uploaded XML file. This issue arises from the default acceptance of XML uploads, which can lead to security breaches if not properly managed.
Vulnerability Detail
The vulnerability identified as CVE-2026-105868 allows uploaded XML files to execute JavaScript in the Payload origin when opened by a logged-in user. This occurs under specific local upload configurations where an XML file and its associated stylesheet can be processed, leading to potential cross-site scripting (XSS) attacks. The risk is heightened for applications that accept XML uploads by default, making it critical for developers to address this issue promptly.
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.90.03.90.0npm install payload@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install payload@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advisable to disallow XML/XSL uploads in your application settings to prevent potential exploitation of this vulnerability.
Conclusion
In summary, CVE-2026-105868 poses a significant risk to applications using the Payload package due to its handling of XML uploads. It is crucial for developers to upgrade to the patched versions or implement workarounds to safeguard their applications from potential exploitation.
See every vulnerability recorded for payload →
FAQ
CVE-2026-105868 is a vulnerability in the Payload package that allows uploaded XML files to execute JavaScript in the same origin when opened by a logged-in user.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring any installation.
If exploited, this vulnerability can lead to unauthorized execution of JavaScript, potentially compromising user data and application integrity.
If an immediate upgrade is not possible, you should implement the workaround by disallowing XML/XSL uploads to mitigate the risk.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
