critical vulnerability

Payload Form Builder has an RCE issue

Fix availableCritical · CVSS 10EPSS 0.43%

Published Oct 7, 2026 · updated Oct 7, 2026

What to do

Upgrade to a fixed version: @payloadcms/plugin-form-builder 3.90.0, @payloadcms/plugin-form-builder 4.0.0-canary.34.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npm@payloadcms/plugin-form-builder

Vulnerable versions: < 3.90.0
Fixed in: 3.90.0

Check your project: npm ls @payloadcms/plugin-form-builder --all

Is @payloadcms/plugin-form-builder@3.90.0 safe to install? See the upgrade verdict →

npm@payloadcms/plugin-form-builder

Vulnerable versions: >= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in: 4.0.0-canary.34

Check your project: npm ls @payloadcms/plugin-form-builder --all

Is @payloadcms/plugin-form-builder@4.0.0-canary.34 safe to install? See the upgrade verdict →

Sources

CWE-94 Improper Control of Generation of Code ('Code Injection') · CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

← All critical vulnerabilities