CVE-2026-22814: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22814 is a Mass Assignment vulnerability in @adonisjs/lucid, the SQL ORM for the AdonisJS framework built on top of Knex. It allows a remote attacker who can influence data passed into Lucid model assignments to overwrite internal ORM state properties, potentially leading to logic bypasses and unauthorized database record modification. The vulnerability affects @adonisjs/lucid versions up to and including 21.8.1, and 22.x pre-release versions from 22.0.0-next.0 through 22.0.0-next.5. It was disclosed on January 13, 2026, by RomainLanz via the GitHub Security Advisory GHSA-g5gc-h5hp-555f, with credit to reporter wodzen. The CVSS v4.0 base score is 8.2 (High) (Github Advisory, AdonisJS Advisory).

The root cause is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The vulnerability exists in the BaseModelImpl class, which uses a this.hasOwnProperty(key) check to determine valid assignment targets. Because internal ORM state properties ($isPersisted, $attributes, $original, $isDeleted) are initialized as instance properties, they pass this check — allowing attacker-controlled input to overwrite them. The flaw propagates across the entire write surface of the library, including instance methods fill and merge, creation methods create, createQuietly, firstOrNew, firstOrCreate, updateOrCreate, and bulk operations such as createMany and updateOrCreateMany. Applications are vulnerable when they pass unvalidated or loosely validated data (e.g., via request.all(), request.except(), or schemas with allowUnknownProperties) directly to model methods (AdonisJS Advisory, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to manipulate the ORM's internal state, enabling unauthorized modification of database records. By injecting "$isPersisted": true into a payload, an attacker can force save() to execute an UPDATE operation instead of an INSERT, effectively modifying existing records rather than creating new ones. Additionally, injecting into $attributes can bypass field-level validators and restrictions, allowing unauthorized data to be persisted to the database. There is no confidentiality or availability impact, but the integrity impact is high, with potential for data tampering and database state manipulation across any table or model exposed through a vulnerable endpoint (AdonisJS Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.037% (11th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that the target application passes unvalidated or insufficiently validated user input directly to Lucid model methods, which is a prerequisite (Attack Requirements: Present in CVSS v4.0) (Github Advisory, Feedly).

1. Reconnaissance: Identify web applications built on AdonisJS that use @adonisjs/lucid versions ≤ 21.8.1 or 22.0.0-next.0 through 22.0.0-next.5. Look for endpoints that accept user-supplied JSON or form data and pass it to model creation or update operations.
2. Identify vulnerable endpoint: Find an API route or form handler that calls Model.create(), model.merge(), model.fill(), or similar methods using request.all() or request.except() without strict allow-list validation.
3. Craft malicious payload: Construct a JSON payload that includes internal ORM property keys alongside normal fields. For example, to convert an INSERT into an UPDATE: { "name": "attacker", "$isPersisted": true, "$attributes": { "role": "admin" } }.
4. Submit the payload: Send the crafted payload to the vulnerable endpoint via an HTTP POST or PUT request.
5. Achieve unauthorized record modification: The hasOwnProperty check in BaseModelImpl passes for $isPersisted and $attributes since they are instance properties. The ORM executes an UPDATE instead of INSERT, or persists attacker-controlled attribute values that bypass field validators, resulting in unauthorized database record modification (AdonisJS Advisory).

• Network: HTTP POST/PUT requests to model-creation or update endpoints containing JSON keys prefixed with $ (e.g., $isPersisted, $attributes, $isDeleted, $original) in the request body.
• Logs: Application logs showing unexpected UPDATE database operations on records that should have been newly created (INSERT); anomalous changes to records with no corresponding user-initiated update action.
• Application Behavior: Database records with unexpected field values (e.g., elevated roles or permissions) that do not correspond to legitimate user input; records modified at timestamps inconsistent with user activity.
• Database: Audit logs showing UPDATE statements on rows where only INSERT was expected, particularly for user registration, profile creation, or similar flows.

Upgrade @adonisjs/lucid to version 21.8.2 (stable) or 22.0.0-next.6 (pre-release) or later, which contain the official patch (AdonisJS Advisory). As an immediate workaround, implement strict allow-list validation for all user input before passing it to ORM methods — explicitly discard unknown properties and avoid passing request.all() or request.except() directly to Model.create() or similar methods. Use schema validation with allowUnknownProperties set to false to ensure internal ORM keys cannot be injected by user-controlled data.

The advisory was published by AdonisJS maintainer RomainLanz on January 13, 2026, and credited to security researcher wodzen. Coverage has been limited to vulnerability aggregation platforms such as Vulners, CVEFeed, and INCIBE-CERT, with no significant broader media or social media discussion identified (AdonisJS Advisory).