Server side template injection In @payloadcms/plugin-form-builder
Description
Payload Form Builder has an RCE issue
Impact
A vulnerability in @payloadcms/plugin-form-builder in versions < 3.90.0 allow submissions which could be crafted to execute remote code on the server.
You are affected if:
You are using @payloadcms/plugin-form-builder
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 3.90.0, 4.0.0-canary.34 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.