Read the docs
TI-2026-18330 Aliases CVE-2026-22814GHSA-g5gc-h5hp-555f

Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State

Priority MEDIUM 42CWE-915Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-915.

Summary

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00536 45th percentileScored 2026-11-07
Fix Fixed lucid (adonisjs): 21.8.2, 22.0.0-next.6@adonisjs/lucid (npm): 21.8.2, 22.0.0-next.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
adonisjslucidbefore 21.8.2; 22.0.0-next.0 to before 22.0.0-next.621.8.2, 22.0.0-next.6Patch availableCNA
—@adonisjs/lucid (npm)before 21.8.221.8.2Patch availableGHSA-g5gc-h5hp-555f
—@adonisjs/lucid (npm)22.0.0-next.0 to before 22.0.0-next.622.0.0-next.6Patch availableGHSA-g5gc-h5hp-555f
  • lucid Vendoradonisjs Affected before 21.8.2; 22.0.0-next.0 to before 22.0.0-next.6 Fixed in 21.8.2, 22.0.0-next.6 Patch available CNA
  • @adonisjs/lucid (npm) Vendor— Affected before 21.8.2 Fixed in 21.8.2 Patch available GHSA-g5gc-h5hp-555f
  • @adonisjs/lucid (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.0-next.6 Fixed in 22.0.0-next.6 Patch available GHSA-g5gc-h5hp-555f

Remediation

  • Fix · CNA lucid (adonisjs) Fixed in 21.8.2, 22.0.0-next.6
  • Fix · GHSA-g5gc-h5hp-555f @adonisjs/lucid (npm) Fixed in 21.8.2 Advisory →
  • Fix · GHSA-g5gc-h5hp-555f @adonisjs/lucid (npm) Fixed in 22.0.0-next.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22814
  2. 2026-10-03 Alias added: GHSA-g5gc-h5hp-555f

References

Advisory 1

Other 2

  • TI-2026-74653 Regex backtracking in AdonisJS HTTP Server slug matcher exhausts CPU CVSS 4.0HIGH 8.7
  • TI-2026-36065 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser CVSS 3.1HIGH 8.6
  • TI-2026-17325 AdonisJS Path Traversal in Multipart File Handling CVSS 4.0CRITICAL 9.2
  • TI-2026-20829 Uncontrolled resource consumption in adonisjs core CVSS 3.1HIGH 7.5
  • TI-2026-20822 AdonisJS multipart body parsing has Prototype Pollution issue CVSS 3.1HIGH 7.2
  • TI-2021-06134 Cross-site scripting (XSS) in edge.js CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences