No official fix confirmed yet
Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.
Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.
| Product | Vendor | Affected versions | Fixed in | Source |
|---|---|---|---|---|
| Strapi | Strapi | >= 3.0.0, < 4.5.6 | 4.5.6 | NVD |
Sources: NVD = NIST National Vulnerability Database.
Developments from the last 30 days, newest first.
CVE-2023-22621 scored CVSS 7.2
Basis: NIST National Vulnerability Database
CISA lists this as exploited in the wild. Unpatched Strapi systems are exposed to active attacks now.
Apply the vendor's security update for Strapi.
