@payloadcms/next has Stored XSS in Admin Panel
Impact
A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser.
Consumers are affected if ALL of these are true:
- Payload version < v3.78.0
- At least one collection with versions enabled
- An authenticated user has
createorupdateaccess to that collection
Patches
This vulnerability has been patched in v3.78.0. Output encoding has been added to prevent user-supplied content from being interpreted as markup.
Users should upgrade to v3.78.0 or later.
Workarounds
If consumers cannot upgrade immediately:
- Restrict
createandupdateaccess to versioned collections to trusted roles only.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @payloadcms/next | < 3.78.0 | 3.78.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
@payloadcms/next- Disclosed
- 01.04.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mmxc-95ch-2j7c - CC BY 4.0
Vulnerability history: @payloadcms/next
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 08.2025 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 3
Disclosures per year
- 2025: 2
- 2026: 2
-
@payloadcms/next has Stored XSS in Admin Panel this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.