Description
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
sofianeelhor/CVE-2023-22621-POC ★ 23 · Apr 25, 2023
CVE-2023-22621: SSTI to RCE by Exploiting Email Templates affecting Strapi Versions <=4.5.5
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Strapi Versions <=4.5.5 - SSTI to Remote Code Execution http/cves/2023/CVE-2023-22621.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @strapi/plugin-email | < 4.5.6 | 4.5.6 | GHSA-2h87-4q2w-v4hf |
| npm | @strapi/plugin-users-permissions | < 4.5.6 | 4.5.6 | GHSA-2h87-4q2w-v4hf |
Advisories 1
- WID-SEC-2023-1040 Strapi: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2026