Vendor

    Strapi

    46 known vulnerabilities in products by Strapi, 1 of them actively exploited (CISA KEV).

    Key figures

    46

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    9

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Strapi
    CriticalCVE-2023-22894

    Strapi Cleartext Storage of Sensitive Information Vulnerability

    In CISA KEV

    		4.9
    CriticalCVE-2019-18818

    Strapi: security vulnerability

    		9.8
    CriticalCVE-2023-22621

    Strapi: Template Injection

    		7.2
    HighCVE-2019-19609

    Strapi: Remote Code Execution

    		7.2
    CriticalCVE-2026-27886

    Strapi may leak sensitive data via relational filtering due to lack of query sanitization

    		7.5
    CriticalCVE-2022-27263

    Strapi: Unrestricted File Upload

    		9.8
    HighCVE-2023-22893

    Strapi: Authentication Bypass

    		7.5
    CriticalCVE-2020-27664

    Strapi: security vulnerability

    		9.8
    CriticalCVE-2026-22599

    Strapi Vulnerable to SQL Injection in Content Type Builder

    		7.2
    HighCVE-2021-46440

    Strapi: security vulnerability

    		7.5
    HighCVE-2022-32114

    Strapi: Cross-Site Scripting (XSS)

    		8.8
    HighCVE-2022-31367

    Strapi: security vulnerability

    		8.8
    HighCVE-2022-30617

    Strapi: Improper Removal of Sensitive Information Before Storage or Transfer

    		8.8
    CriticalCVE-2026-90561

    Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

    also in 1 other product

    		8.7
    HighCVE-2023-34235

    Leaking sensitive user information still possible by filtering on private with prefix fields

    		8.6
    HighCVE-2021-28128

    Strapi: security vulnerability

    		8.1
    MediumCVE-2020-13961

    Strapi: security vulnerability

    		6.5
    HighCVE-2020-27665

    Strapi: security vulnerability

    		7.5
    CriticalCVE-2023-38507

    Strapi Improper Rate Limiting vulnerability

    		7.3
    HighCVE-2022-30618

    Strapi: Improper Removal of Sensitive Information Before Storage or Transfer

    		7.5
    MediumCVE-2025-64526

    Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

    		5.3
    HighCVE-2024-37818

    Strapi: Server-Side Request Forgery (SSRF)

    		8.6
    MediumCVE-2025-3930

    Lack of JWT Expiration after Log Out in Strapi

    		—
    HighCVE-2024-34065

    @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass

    		7.1
    HighCVE-2024-56143

    Strapi Allows Unauthorized Access to Private Fields via parms.lookup

    		8.2

    All vulnerabilities in search

    Products

    Products by Strapi
    Strapi421
    Strapi Open Source And Enterprise Headless CMS30