Mass Assignment allows a remote attacker who can influence data passed into AdonisJS Lucid model assignments to overwrite the internal ORM state. This flaw permits logic bypasses and unauthorized record modifications within a table or model. The weakness is classified as CWE‑915, reflecting improper data handling leading to loss of control over program flow.

The vulnerability affects the AdonisJS Lucid SQL ORM, versions through 21.8.1 and all 22.x pre‑release releases prior to 22.0.0‑next.6 . Users of these versions are at risk.

The CVSS score of 8.2 denotes a high severity risk, yet the EPSS score is below 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring an attacker to supply crafted data that is subsequently assigned to a Lucid model – a scenario that is common when user input is bound to models without proper safeguards.