CVE-2026-22814: AdonisJS Lucid mass assignment in model state

CVE-2026-22814 · Severity: medium · CVSS 4 · Published 2026-01-13

AdonisJS Lucid is a database ORM library used by Node.js web applications to manage data and database operations. A mass assignment vulnerability allows attackers to inject arbitrary internal ORM properties into model creation or update operations, enabling them to bypass record modification restrictions, convert insert operations to updates, and circumvent application logic by directly manipulating the database persistence state.

Vendors: AdonisJS.

Quick answers

Is CVE-2026-22814 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22814 being exploited in the wild.
How severe is CVE-2026-22814?
Medium severity, with a CVSS score of 4, published 13 January 2026.
Which products and versions are affected?
AdonisJS Lucid <= 21.8.1, 22.0.0-next.0 through 22.0.0-next.5.
Is there a fix for CVE-2026-22814?
A patch was published on 2026-01-13: Patches released in versions 21.8.2 and 22.0.0-next.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22814 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22814?
Check whether you run AdonisJS Lucid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A mass assignment (CWE-915) vulnerability in the BaseModelImpl class of @adonisjs/lucid allows attackers to overwrite internal ORM state properties via model assignment methods (fill, merge, create, createMany, updateOrCreate, etc.). The vulnerability arises because the library validates property assignment using hasOwnProperty(key), which passes for internal instance properties like $isPersisted, $attributes, $original, and $isDeleted. An attacker who can influence the payload passed to model creation or update methods (e.g., via unvalidated request data) can inject these internal keys to hijack ORM logic—for example, setting $isPersisted: true forces an INSERT operation to become an UPDATE, or modifying $attributes bypasses validators. The attack requires network access and the ability to influence data passed to vulnerable model methods; applications using strict input allow lists that drop unknown properties are not affected. Patches are available in versions 21.8.2 and 22.0.0-next.6.

Affected products

  • AdonisJS Lucid <= 21.8.1, 22.0.0-next.0 through 22.0.0-next.5

Identifiers

  • CVE-2026-22814
  • GHSA-g5gc-h5hp-555f

Timeline

  • 2026-01-13: disclosed: Vulnerability published
  • 2026-01-13: patched: Patches released in versions 21.8.2 and 22.0.0-next.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.