Skip to content
OpenAdvisories

Package · npm

@strapi/strapi

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.6
    CVE-2024-37818

    Strapi Server-Side Request Forgery (SSRF)

    Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Deve…

    @strapi/strapi npm
  • High 7.6
    CVE-2023-39345

    Unauthorized Access to Private Fields in User Registration API in strapi

    strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has be…

    strapi strapi @strapi/strapi @strapi/plugin-users-permissions npm
  • High 7.2
    CVE-2023-22894 Exploited Public exploit

    Strapi leaking sensitive user information by filtering on private fields

    Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the …

    @strapi/strapi npm
    KEV Oct 8, 2026
  • High 8.8
    CVE-2022-31367

    Strapi mishandles hidden attributes within admin API responses

    Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.

    strapi @strapi/strapi npm
  • High 7.5
    CVE-2022-30618

    Improper Removal of Sensitive Information Before Storage or Transfer in Strapi

    An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permis…

    strapi strapi strapi @strapi/strapi npm
  • High 8.8
    CVE-2022-30617

    Improper Removal of Sensitive Information Before Storage or Transfer in Strapi

    An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authen…

    strapi strapi strapi @strapi/strapi npm
  • High 7.5
    CVE-2021-46440

    Insecure password handling vulnerability in Strapi

    Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obta…

    strapi @strapi/strapi npm