High, CVSS 8.2npmAmendedPublished
Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State
CVE-2026-22814 · GHSA-g5gc-h5hp-555f
- Affected
- npm @adonisjs/lucid <= 21.8.1; >= 22.0.0-next.0, < 22.0.0-next.6
- Fixed in
- 22.0.0-next.621.8.2· Vendor fix available
- Issue
- Description A Mass Assignment (CWE-915) vulnerability in AdonisJS Lucid may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6. Details A vulnerability in the BaseModelImpl class of @adonisjs/lucid may allow an attacker to overwrite internal class properties (such as $isPersisted, $attributes, or $isDeleted) when passing plain objects to model assignment methods. The library relies on a this.hasOwnProperty(key) check to validate assignment targets. However, because internal ORM state properties are initialized as instance properties, they pass this check. Consequently, if an attacker can influence specific keys (like $isPersisted)…
Recommended action: Upgrade to 22.0.0-next.6 (pre-release) or 21.8.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.