CVE-2026-22814
Description
@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assignment vulnerability in AdonisJS Lucid which may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.
How to fix
- @adonisjs/lucid21.8.2, 22.0.0-next.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @adonisjs/lucidnpm | v < 21.8.2, 22.0.0-next.0 ≤ v < 22.0.0-next.6 | 21.8.2, 22.0.0-next.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.