PT-2026-2797 · Adonisjs · @Adonisjs/Lucid

Wodzen · Published 2026-01-13 · Updated 2026-01-13 · CVE-2026-22814

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @adonisjs/lucid versions prior to 21.8.2 @adonisjs/lucid versions prior to 22.0.0-next.6

Description A Mass Assignment issue exists in @adonisjs/lucid, an SQL ORM for AdonisJS. A remote attacker who can influence data passed into Lucid model assignments may be able to overwrite the internal ORM state, potentially leading to logic bypasses and unauthorized record modification.

Recommendations Update to @adonisjs/lucid version 21.8.2. Update to @adonisjs/lucid version 22.0.0-next.6.

Exploit

Fix

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-22814

GHSA-G5GC-H5HP-555F

Affected Products

@Adonisjs/Lucid

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22814.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-22814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22814 · Security Note
• https://osv.dev/vulnerability/GHSA-g5gc-h5hp-555f · Vendor Advisory
• https://github.com/adonisjs/lucid · Note
• https://github.com/adonisjs/lucid/security/advisories/GHSA-g5gc-h5hp-555f · Note
• https://twitter.com/CVEnew/status/2011181478185685363 · Twitter Post
• https://twitter.com/adonisframework/status/2010974092418039999 · Twitter Post