@strapi/strapi
11 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for @strapi/strapi, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
@strapi/strapi CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 1 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 11 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High7
- Medium3
Latest CVEs
The 11 most recently published vulnerabilities affecting @strapi/strapi.
- CVE-2025-3930Lack of JWT Expiration after Log Out in Strapi—
- CVE-2024-37818Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitiv...8.6
- CVE-2023-39345Unauthorized Access to Private Fields in User Registration API in strapi7.6
- CVE-2023-34093Strapi allows actors to make all attributes on a content-type public without noticing it4.8
- CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensi...4.9
- CVE-2022-31367Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.8.8
- CVE-2022-32114An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests th...8.8
- CVE-2022-30618An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authentica...7.5
- CVE-2022-30617An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g.,...8.8
- CVE-2021-46440Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's co...7.5
- CVE-2022-0764Arbitrary Command Injection in strapi/strapi6.7
Product grouping is registry-driven, with AI assist and human review. How it works