# strapi (npm) vulnerabilities 12 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.6.11 (Nov 22, 2022): affected by 2 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 11.9K - Dependents: 10 - Releases: 303 since 1.0.0 (Sep 30, 2015) - Registry: https://www.npmjs.com/package/strapi - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2022-31367: 1.0.0 to 3.6.9 (3.6.10 is outside it) - CVE-2022-29894: 1.0.0 to 3.6.10 (3.6.11 is outside it) - CVE-2022-30618: 3.0.0 to 3.6.8 (3.6.9 is outside it) - CVE-2022-30617: 3.0.0 to 3.6.8 (3.6.9 is outside it) - CVE-2021-46440: 1.0.0 to 3.6.8 (3.6.9 is outside it) - CVE-2022-27263: 1.0.0 to 3.6.11 (through the newest release) - CVE-2022-0764: 1.0.0 to 3.6.11 (through the newest release) - CVE-2021-28128: 1.0.0 to 3.6.0 (3.6.1 is outside it) - CVE-2020-27664: 1.0.0 to 3.2.4 (3.2.5 is outside it) - CVE-2020-13961: 1.0.0 to 3.0.2-next.48 (3.0.2 is outside it) - CVE-2019-19609: 1.0.0 to 3.0.0-beta.17.7 (3.0.0-beta.17.8 is outside it) - CVE-2019-18818: 1.0.0 to 3.0.0-beta.17.4 (3.0.0-beta.17.5 is outside it) ## Advisories (12) ### [CVE-2022-31367](https://cve.now/CVE-2022-31367): Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. - Severity: High 8.8 - Published: Sep 27, 2022 - Affected: fixed in 3.6.10. - Fixed in 3.6.10 (released May 11, 2022, 139 days before disclosure). - The latest release, 3.6.11, is not affected. - 75% of strapi downloads last week were affected versions (12.1K). ### [CVE-2022-29894](https://cve.now/CVE-2022-29894): Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. - Severity: Unrated - Published: Jun 13, 2022 - Affected: through 3.6.10. - Fixed in 3.6.11 (released Nov 22, 2022, 162 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.6.11, is not affected. - 76% of strapi downloads last week were affected versions (12.4K). ### [CVE-2022-30618](https://cve.now/CVE-2022-30618): An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens… - Severity: Unrated - Published: May 19, 2022 - Affected: from 3.0.0, fixed in 3.6.9. - Fixed in 3.6.9 (released Feb 16, 2022, 92 days before disclosure). - The latest release, 3.6.11, is not affected. - 32% of strapi downloads last week were affected versions (5.2K). ### [CVE-2022-30617](https://cve.now/CVE-2022-30617): An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens… - Severity: Unrated - Published: May 19, 2022 - Affected: from 3.0.0, fixed in 3.6.9. - Fixed in 3.6.9 (released Feb 16, 2022, 92 days before disclosure). - The latest release, 3.6.11, is not affected. - 32% of strapi downloads last week were affected versions (5.2K). ### [CVE-2021-46440](https://cve.now/CVE-2021-46440): Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an… - Severity: Unrated - Published: May 3, 2022 - Affected: fixed in 3.6.9. - Fixed in 3.6.9 (released Feb 16, 2022, 76 days before disclosure). - The latest release, 3.6.11, is not affected. - 37% of strapi downloads last week were affected versions (5.9K). ### [CVE-2022-27263](https://cve.now/CVE-2022-27263): An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted… - Severity: Unrated - Published: Apr 12, 2022 - Affected: through 4.1.5. - No fix released. The latest release, 3.6.11, is still affected. - 100% of strapi downloads last week were affected versions (16.2K). ### [CVE-2022-0764](https://cve.now/CVE-2022-0764): Arbitrary Command Injection in strapi/strapi - Severity: Medium 6.1 - Published: Feb 26, 2022 - Affected: fixed in 4.1.0. - No fix released. The advisory names 4.1.0 as the fix, which the registry doesn't have yet. The latest release, 3.6.11, is still affected. - 100% of strapi downloads last week were affected versions (16.2K). ### [CVE-2021-28128](https://cve.now/CVE-2021-28128): In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. - Severity: Unrated - Published: May 6, 2021 - Affected: through 3.6.0. - Fixed in 3.6.1 (released Apr 29, 2021, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.6.11, is not affected. - 17% of strapi downloads last week were affected versions (2.7K). ### [CVE-2020-27664](https://cve.now/CVE-2020-27664): admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality. - Severity: Unrated - Published: Oct 22, 2020 - Affected: fixed in 3.2.5. - Fixed in 3.2.5 (released Oct 22, 2020, the day of disclosure). - The latest release, 3.6.11, is not affected. - 7.9% of strapi downloads last week were affected versions (1.3K). ### [CVE-2020-13961](https://cve.now/CVE-2020-13961): Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global… - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 3.0.2. - Fixed in 3.0.2 (released Jun 15, 2020, 4 days before disclosure). - The latest release, 3.6.11, is not affected. - 4.9% of strapi downloads last week were affected versions (796). ### [CVE-2019-19609](https://cve.now/CVE-2019-19609): The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the… - Severity: Unrated - Published: Dec 5, 2019 - Affected: fixed in 3.0.0-beta.17.8. - Fixed in 3.0.0-beta.17.8 (released Dec 1, 2019, 4 days before disclosure). - The latest release, 3.6.11, is not affected. - 3.7% of strapi downloads last week were affected versions (598). ### [CVE-2019-18818](https://cve.now/CVE-2019-18818): strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and… - Severity: Unrated - Published: Nov 7, 2019 - Affected: fixed in 3.0.0-beta.17.5. - Fixed in 3.0.0-beta.17.5 (released Nov 4, 2019, 3 days before disclosure). - The latest release, 3.6.11, is not affected. - 3.2% of strapi downloads last week were affected versions (516). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/strapi Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.