Which versions of Strapi are affected by CVE-2026-22599?

Strapi's content-type-builder plugin (versions 5.0-5.33.1 and 4.0-4.26.0) contains a critical SQL injection vulnerability that could allow attackers to access or modify database content and…. A patch is available.

How to fix or mitigate CVE-2026-22599?

Within 24 hours: Audit all Strapi installations and document current @strapi/content-type-builder and @strapi/plugin-content-type-builder versions. Within 7 days: Deploy patches to version 5.33.2 or later (v5) and version 4.26.1 or later (v4) across all affected systems. Within 30 days: Validate patch deployment, review database access logs for suspicious activity between vulnerability disclosure and remediation.

Strapi CVE-2026-22599

Q: What is the CVSS score of CVE-2026-22599?

CVE-2026-22599 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30352 CRITICAL

SQL Injection (CWE-89)

2026-05-13 https://github.com/strapi/strapi

GHSA-3xcq-8mjw-h6mx

Denial Of Service SQLi RCE

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 08:27 vuln.today

Analysis Generated

Jun 08, 2026 - 08:27 vuln.today

CVSS changed

May 14, 2026 - 19:22 NVD

9.3 (CRITICAL)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @strapi/content-type-builder (1 direct, 0 indirect)
1 npm packages depend on @strapi/plugin-content-type-builder (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.0.0 and other introduced versions.

DescriptionGitHub Advisory

Summary of CVE-2026-22599 Vulnerability Details

CVE: CVE-2026-22599
CVSS v3.1 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N (9.3 - Critical)
Affected Versions: @strapi/content-type-builder <=5.33.1 (v5), @strapi/plugin-content-type-builder <=4.26.0 (v4)
How to Patch: Immediately update your Strapi to >=5.33.2 (v5) or >=4.26.1 (v4)

Description of CVE-2026-22599

A database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the column.defaultTo attribute when creating or modifying a content type. Setting defaultTo as a tuple [value, { isRaw: true }] caused the value to be passed directly into Knex's db.connection.raw() during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server.

The patch addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against /content-type-builder/content-types and related endpoints, removing the network-reachable attack surface entirely.

IoC's for CVE-2026-22599

Indicators that an instance running an unpatched version may have been exploited:

HTTP access logs containing POST or PUT requests to /content-type-builder/content-types from a non-internal source. Regex pattern: (POST|PUT)\s+/content-type-builder/
Database server logs containing unexpected DEFAULT clause values that reference filesystem-access or program-execution helper functions of your database engine
Strapi server crashes immediately following a content-type creation or update, observed as the Node process exiting during the schema-migration step
Files appearing under unexpected paths on the database host that match content-type DEFAULT values from the application
Newly-created content-types named or shaped to extract specific data (attribute names like passwd, etc, env, config)

AnalysisAI

{ isRaw: true }] tuple, which is passed directly into Knex's db.connection.raw()` without sanitization. Affected versions are @strapi/content-type-builder <=5.33.1 (v5) and @strapi/plugin-content-type-builder <=4.26.0 (v4), with impact ranging from arbitrary file read and denial of service to remote code execution on database engines that permit external program execution. No public exploit identified at time of analysis; EPSS is low at 0.13% and CISA SSVC notes exploitation status of 'none', though vendor-confirmed remediation is available.

Technical ContextAI

Strapi is an open-source headless CMS built on Node.js that uses the Knex.js query builder to abstract schema migrations across multiple database engines (PostgreSQL, MySQL, SQLite, MariaDB). The Content-Type Builder plugin exposes admin-facing endpoints under /content-type-builder/content-types that let administrators define data models and trigger schema migrations at runtime. The root cause is CWE-89 (SQL Injection): Knex supports a { isRaw: true } flag that bypasses parameter binding and routes input through db.connection.raw(), and the Content-Type Builder accepted user-supplied defaultTo tuples without filtering this flag, letting any string be appended verbatim into a DEFAULT clause during DDL execution. Because DDL on most engines is privileged and can invoke filesystem or program-execution helpers (e.g., PostgreSQL's COPY/PROGRAM, MySQL's LOAD_FILE), the injection escalates beyond data tampering into OS-level impact on the database host.

RemediationAI

Vendor-released patches: upgrade @strapi/content-type-builder to 5.33.2 or later for v5 deployments, and @strapi/plugin-content-type-builder to 4.26.1 or later for v4 deployments, per release notes at https://github.com/strapi/strapi/releases/tag/v5.33.2 and https://github.com/strapi/strapi/releases/tag/v4.26.1. The patch restricts Content-Type Builder write endpoints to development mode only, so production instances will return 404 for POST/PUT against /content-type-builder/content-types - verify that no production CI or tooling relies on runtime schema mutation before rolling out. As compensating controls until patching, place the admin panel and /content-type-builder/ routes behind a VPN or IP allowlist, enforce strong MFA on all Strapi admin accounts, and run the underlying database with the least-privileged user possible (no superuser, no filesystem helper extensions enabled) to blunt the file-read and RCE impact paths; the trade-off is that legitimate admins must now operate over the restricted network path. Monitor with the IoC regex (POST|PUT)\s+/content-type-builder/ from external sources and look for DEFAULT-clause values referencing OS helper functions. Full advisory: https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx.