CVE-2026-25544: SQL Injection Vulnerability in @payloadcms/drizzle Affects JSON/RichText Queries
Summary
CVE-2026-25544: @payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters. Affects @payloadcms/drizzle versions < 3.73.0. Fixed in 3.73.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @payloadcms/drizzle package is a database adapter designed for use with Payload CMS, facilitating interactions with various databases such as PostgreSQL and SQLite. It allows developers to manage content efficiently while providing features like JSON and richText fields for flexible data storage. However, a critical vulnerability has been identified that exposes these fields to SQL injection attacks, potentially compromising sensitive user data.
Vulnerability Detail
The vulnerability arises from the way user input is handled when querying JSON or richText fields. Specifically, user input is directly embedded into SQL queries without proper escaping, which opens the door for blind SQL injection attacks. An unauthenticated attacker can exploit this flaw to extract sensitive information, such as email addresses and password reset tokens, leading to full account takeover without the need for password cracking. This vulnerability is particularly concerning for applications that utilize Drizzle-based database adapters and have accessible collections with JSON or richText fields.
How To Fix
Minimum fixed version
3.73.0
This is the first release that contains the fix.
npm install @payloadcms/drizzle@3.73.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to restrict access to JSON and richText fields by adding the following code to your field definitions: 'access: { read: () => false }'. This will prevent unauthorized access to these fields until the package can be updated.
Conclusion
In summary, the CVE-2026-25544 vulnerability in the @payloadcms/drizzle package poses a significant risk due to SQL injection possibilities in JSON and richText queries. Users are urged to upgrade to version 3.73.0 or later to mitigate this risk. For those unable to upgrade immediately, a temporary workaround is available to restrict access to vulnerable fields.
See every vulnerability recorded for @payloadcms/drizzle →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of risk.
Users of @payloadcms/drizzle with versions below 3.73.0, using specific database adapters and having accessible JSON or richText fields are affected.
An attacker could exploit this vulnerability to extract sensitive data and potentially take over user accounts without needing to crack passwords.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Implement the temporary workaround by restricting access to JSON and richText fields until you can upgrade to the patched version.
