Skip to content
OpenAdvisories

Package · npm

@strapi/strapi

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.2
    CVE-2026-27886 Public exploit Scanner template

    Strapi may leak sensitive data via relational filtering due to lack of query sanitization

    Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` q…

    strapi strapi @strapi/strapi npm