Mass Assignment Vulnerability in @adonisjs/lucid for AdonisJS
CVE-2026-22814

8.2HIGH

Key Information:

Vendor

Adonisjs

Status
Lucid
Vendor
CVE Published:
13 January 2026

What is CVE-2026-22814?

@adonisjs/lucid, an SQL ORM for AdonisJS built on Knex, contains a mass assignment vulnerability that may allow remote attackers to manipulate data passed into the Lucid model assignments. This can result in unauthorized modifications to the internal ORM state, leading to logic bypasses and unintended alterations of database records. This vulnerability exists in versions up to 21.8.1 and pre-release versions of 22.x, with patches available in versions 21.8.2 and 22.0.0-next.6. For more details, refer to the advisory.

Affected Version(s)

lucid < 21.8.2 < 21.8.2

lucid >= 22.0.0-next.0, < 22.0.0-next.6 < 22.0.0-next.0, 22.0.0-next.6

References

https://github.com/adonisjs/lucid/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.