payload

Node, React, Headless CMS and Application Framework built on Next.js

Latest 3.90.2

NPM

84%

Total Score

healthy

Healthy, with workflow permission and injection findings that merit attention before adopting this release.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No registry build attestation or trusted-publisher provenance is present, leaving release origin less independently verifiable despite the active, established repository.

Workflow audit

All 16 workflows were analyzed with no untrusted checkouts or script-injection findings, but three high-confidence template-injection findings and two high-confidence github-app findings expose workflow hygiene and token-scope concerns. Twenty-nine of 65 action references are unpinned, adding reproducibility risk.

Vulnerabilities

Title	Versions	Severity
CVE-2026-105858 New payload is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 3.90.0 and 4.0.0-canary.0 - 4.0.0-canary.34.	0.0.0 - 3.90.04.0.0-canary.0 - 4.0.0-canary.34	High
CVE-2026-105861 New payload is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 3.0.0 - 3.90.0 and 4.0.0-canary.0 - 4.0.0-canary.34.	3.0.0 - 3.90.04.0.0-canary.0 - 4.0.0-canary.34	High
CVE-2026-105862 New payload is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 3.90.0 and 4.0.0-canary.0 - 4.0.0-canary.34.	0.0.0 - 3.90.04.0.0-canary.0 - 4.0.0-canary.34	High
CVE-2026-105865 New payload is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 3.90.0 and 4.0.0-canary.0 - 4.0.0-canary.34.	0.0.0 - 3.90.04.0.0-canary.0 - 4.0.0-canary.34	High
CVE-2026-105866 New payload is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 0.0.0 - 3.90.0 and 4.0.0-canary.0 - 4.0.0-canary.34.	0.0.0 - 3.90.04.0.0-canary.0 - 4.0.0-canary.34	Medium