8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22814

CVE-2026-22814: Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22814

CVE-2026-22814:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@adonisjs/lucid	npm	<= 21.8.1	21.8.2
@adonisjs/lucid	npm	>= 22.0.0-next.0, < 22.0.0-next.6	22.0.0-next.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a mass assignment issue within the AdonisJS Lucid ORM, specifically in the BaseModelImpl class. The core of the problem lies in the merge and $consumeAdapterResult methods. These methods were designed to take a data object and apply its properties to a model instance. The vulnerability arises because they did not properly sanitize the input to prevent the modification of internal properties used by the ORM to manage state, such as $isPersisted, $isDeleted, and $attributes.

The patch introduces a denylist of these internal properties (INTERNAL_INSTANCE_PROPERTIES). The merge and $consumeAdapterResult methods were updated to check incoming keys against this list, ignoring any that match. This prevents attackers from manipulating the ORM's internal logic.

An attacker could exploit this by sending a crafted JSON payload to an endpoint that uses methods like Model.create() or model.fill(). These higher-level methods internally call the vulnerable merge function. For instance, by including "$isPersisted": true in the payload for a new record, an attacker could trick the save() method into performing an UPDATE instead of an INSERT, potentially leading to unauthorized data modification. The identified vulnerable functions, BaseModelImpl.merge and BaseModelImpl.$consumeAdapterResult, are the exact locations where the flawed logic existed and where the fix was applied.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.