EUVD-2026-76986
GHSA-jh7v-p6jw-jwhc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Author-level auth (PR:L) and required victim preview interaction (UI:R); stored XSS crosses into another user's admin session (S:C) yielding high confidentiality/integrity impact, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.
AnalysisAI
Stored cross-site scripting in Strapi's headless CMS admin panel allows a low-privileged Author to inject persistent JavaScript that runs in the session of Editor or Super Admin reviewers. The WYSIWYG preview component (PreviewWysiwyg.tsx) rendered markdown through a sanitize-html configuration set to allowedTags:false, permitting script tags to survive into the DOM; when a higher-privileged user expands the preview pane the payload executes, enabling account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Strapi admin-panel account with at least the Author role (PR:L) able to save rich-text/markdown content, and a higher-privileged victim (Editor or Super Admin) who subsequently opens that entry and expands the WYSIWYG preview pane (UI:P) - the payload does not fire until the preview is rendered. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, base 9.3) is internally consistent with the description: network-reachable admin panel, low attacker privilege (an Author account), and passive victim interaction (a reviewer expanding the preview). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Strapi 5.x to 5.48.1 or later, which replaces the permissive sanitize-html preview logic with a DOMPurify-based sanitizer (fix commit https://github.com/strapi/strapi/commit/875752612c30f951546904a29469e51e17e0ac37). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Strapi installations and verify which versions are deployed in production and staging environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Strapi is the an open-source headless content management system. Rated critical severity (CVSS 9.8), this vulnerability
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XS
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. Rated high severity
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.
Strapi is an open-source content management system. Rated high severity (CVSS 8.1), this vulnerability is remotely explo
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password
strapi is an open-source headless CMS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no au
Strapi is an open-source headless content management system. Rated high severity (CVSS 7.5), this vulnerability is remot
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login pro
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitra
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today