PT-2026-2797 · Adonisjs · @Adonisjs/Lucid

Wodzen · Publicado 2026-01-13 · Atualizado 2026-01-13 · CVE-2026-22814

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @adonisjs/lucid versions prior to 21.8.2 @adonisjs/lucid versions prior to 22.0.0-next.6

Description A Mass Assignment issue exists in @adonisjs/lucid, an SQL ORM for AdonisJS. A remote attacker who can influence data passed into Lucid model assignments may be able to overwrite the internal ORM state, potentially leading to logic bypasses and unauthorized record modification.

Recommendations Update to @adonisjs/lucid version 21.8.2. Update to @adonisjs/lucid version 22.0.0-next.6.

Exploit

Correção

Enumeração de Fraquezas

CWE-915

Identificadores relacionados

CVE-2026-22814

GHSA-G5GC-H5HP-555F

Produtos afetados

@Adonisjs/Lucid

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22814.json · Exploit
• https://github.com/adonisjs/lucid · Nota
• https://github.com/adonisjs/lucid/security/advisories/GHSA-g5gc-h5hp-555f · Nota
• https://osv.dev/vulnerability/CVE-2026-22814 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-22814 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011181478185685363 · Publicação no Twitter
• https://twitter.com/adonisframework/status/2010974092418039999 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-g5gc-h5hp-555f · Aviso do Fabricante