GHSA-8r29-2mp2-pmrw
Payload Ecommerce has an order confirmation validation issue
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-105850
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Description
## Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions. You are affected if: - You use `@payloadcms/plugin-ecommerce` with the Stripe payment adapter. Deployments that do not use the Stripe payment flow are not affected. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · @payloadcms/plugin-ecommerce | introduced 0, fixed 3.90.0 |
| npm · @payloadcms/plugin-ecommerce | introduced 4.0.0-canary.0, fixed 4.0.0-canary.34 |
Références
- https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw WEB
- https://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e WEB
- https://github.com/payloadcms/payload PACKAGE
- https://github.com/payloadcms/payload/releases/tag/v3.90.0 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |