HIGH8.8npm
GHSA-4phg-hpqm-c3j4· CVE-2022-31367Strapi mishandles hidden attributes within admin API responses
Modified: 11/8/2023
package
npm/@strapi/strapi
pkg:npm/%40strapi/strapi
MEDIUMnpm
GHSA-4r8w-3jww-m2rp· CVE-2025-3930Strapi is vulnerable to Insufficient Session Expiration
Modified: 10/22/2025
MEDIUM4.6npm
GHSA-4vm8-j95f-j6v5· CVE-2022-32114Strapi 4.1.12 Cross-site Scripting via crafted file
Modified: 3/21/2024
HIGH7.5npm
GHSA-85vg-grr5-pw42· CVE-2021-46440Insecure password handling vulnerability in Strapi
Modified: 11/8/2023
MEDIUM4.8npm
GHSA-chmr-rg2f-9jmf· CVE-2023-34093Making all attributes on a content-type public without noticing it
Modified: 11/8/2023
HIGH8.8npm
GHSA-f6fm-r26q-p747· CVE-2022-30617Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
Modified: 11/8/2023
HIGH7.6npm
GHSA-gc7p-j5xm-xxh2· CVE-2023-39345Unauthorized Access to Private Fields in User Registration API
Modified: 11/8/2023
HIGH7.5npm
GHSA-jjqf-j4w7-92w8· CVE-2023-22894Strapi leaking sensitive user information by filtering on private fields
Modified: 11/8/2023
HIGH8.6npm
GHSA-p9ff-j98v-p435· CVE-2024-37818Strapi Server-Side Request Forgery (SSRF)
Modified: 10/4/2024
CRITICALnpm
GHSA-rjg2-95x7-8qmx· CVE-2026-27886Strapi may leak sensitive data via relational filtering due to lack of query sanitization
Modified: 5/16/2026
HIGH7.5npm
GHSA-vgj7-895j-gpr6· CVE-2022-30618Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
Modified: 11/8/2023