Log in Start free

Vulnerability · Published Jan 13, 2026 · Assigned by GitHub_M

CVE-2026-22814Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State

High 8.2

In plain English

A high-severity security flaw in lucid from adonisjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.5%top 54.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@adonisjs/lucid21.8.2GHSA-g5gc-h5hp-555f
npm@adonisjs/lucid22.0.0-next.6GHSA-g5gc-h5hp-555f

Affected products (as reported)

VendorProductVersions
adonisjs lucid < 21.8.2>= 22.0.0-next.0, < 22.0.0-next.6

Weakness: CWE-915 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References