Summary
Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State
Description
A Mass Assignment (CWE-915) vulnerability in AdonisJS Lucid may allow a remote attacker who can influence data that is passed into Lucid model assignments to overwrite the internal ORM state. This may lead to logic bypasses and unauthorized record modification within a table or model. This affects @adonisjs/lucid through version 21.8.1 and 22.x pre-release versions prior to 22.0.0-next.6. This has been patched in @adonisjs/lucid versions 21.8.2 and 22.0.0-next.6.
Details
A vulnerability in the BaseModelImpl class of @adonisjs/lucid may allow an attacker to overwrite internal class properties (such as $isPersisted, $attributes, or $isDeleted) when passing plain objects to model assignment methods.
The library relies on a this.hasOwnProperty(key) check to validate assignment targets. However, because internal ORM state properties are initialized as instance properties, they pass this check. Consequently, if an attacker can influence specific keys (like $isPersisted) into the payload passed to merge() or $consumeAdapterResult(), they can hijack the ORM's internal logic.
The exposed internal properties include:
$attributes: The raw storage for model data.$isPersisted: Controls whethersave()performs anINSERTor anUPDATE.$original: Stores the original state of the record used to calculate changes.$isDeleted: Prevents operations on deleted models.
This issue propagates to the entire write surface of the library, including:
- Instance methods
fillandmerge. - Single record creation methods
create,createQuietly,firstOrNew, andfirstOrCreate. - Conditional updates via
updateOrCreate. - Bulk operations
createMany,createManyQuietly,fetchOrNewUpMany,fetchOrCreateMany, andupdateOrCreateMany.
Impact
Applications are vulnerable if they pass unvalidated data or validated data that retains unknown properties to the model. This occurs because internal keys exist as instance properties, causing them to pass the hasOwnProperty check and bypass Lucid's default rejection of unknown properties.
Applications utilizing strict allow lists for input validation that discard unknown properties are not affected.
For example, if a developer passes request.all(), request.except() or a schema with allowUnknownProperties to Model.create(), the ORM's internal logic can be hijacked. Because the Model.create() > save() decision is based on $isPersisted, and merge() can assign to the own-property $isPersisted, an attacker who can inject "$isPersisted": true into the payload can force save() to take the UPDATE branch rather than the INSERT branch, while setting $attributes can bypass validators or field restrictions.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
This issue has been patched in @adonisjs/lucid version 21.8.2 and 22.0.0-next.6. Please upgrade to this version or later.
Developers can mitigate this issue by strictly validating model inputs with an allow list that drops unknown keys if possible.
Frequently Asked Questions
- What is CVE-2026-22814? CVE-2026-22814 is a high-severity security vulnerability in @adonisjs/lucid (npm), affecting versions <= 21.8.1. It is fixed in 21.8.2, 22.0.0-next.6.
- Which versions of @adonisjs/lucid are affected by CVE-2026-22814? @adonisjs/lucid (npm) versions <= 21.8.1 is affected.
- Is there a fix for CVE-2026-22814? Yes. CVE-2026-22814 is fixed in 21.8.2, 22.0.0-next.6. Upgrade to this version or later.
- Is CVE-2026-22814 exploitable, and should I be worried? Whether CVE-2026-22814 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-22814 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-22814?
- Upgrade
@adonisjs/lucidto 21.8.2 or later - Upgrade
@adonisjs/lucidto 22.0.0-next.6 or later
- Upgrade