Skip to content
OpenAdvisories

Package · npm

@strapi/strapi

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2025-3930

    Lack of JWT Expiration after Log Out in Strapi

    Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by d…

    strapi strapi @strapi/strapi npm
  • Medium 4.8
    CVE-2023-34093

    Strapi allows actors to make all attributes on a content-type public without noticing it

    Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types…

    strapi strapi @strapi/strapi @strapi/utils npm
  • Medium 4.6
    CVE-2022-32114 Public exploit

    Strapi 4.1.12 Cross-site Scripting via crafted file

    An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission …

    @strapi/strapi npm