@strapi/strapi
This hub aggregates every CVE we track for @strapi/strapi, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
10
CVEs tracked
0
Critical
7
High
0
In CISA KEV
Severity distribution
HIGH7MEDIUM3
Monthly trend
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2024-102026-09
Latest CVEs
The 10 most recently published vulnerabilities affecting @strapi/strapi.
- CVE-2024-37818Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitiv...8.6
- CVE-2023-39345Unauthorized Access to Private Fields in User Registration API in strapi7.6
- CVE-2023-34093Strapi allows actors to make all attributes on a content-type public without noticing it4.8
- CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensi...4.9
- CVE-2022-31367Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.8.8
- CVE-2022-32114An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests th...8.8
- CVE-2022-30618An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authentica...7.5
- CVE-2022-30617An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g.,...8.8
- CVE-2021-46440Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's co...7.5
- CVE-2022-0764Arbitrary Command Injection in strapi/strapi6.7
Product normalization is registry-driven with AI assist and human review. How it works