CVE-2020-13961: Improper Input Validation in strapi
Summary
CVE-2020-13961: Improper Input Validation in strapi. Affects strapi versions < 3.0.2. Fixed in 3.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Strapi is an open-source headless CMS (Content Management System) that provides a customizable and extensible platform for building APIs. It allows developers to create, manage, and deploy content-rich websites and applications. However, a vulnerability has been identified in Strapi versions before 3.0.2 that could potentially allow a remote authenticated attacker to bypass security restrictions. This vulnerability arises from the improper input validation of email templates, which are stored in a global variable without any sanitation. By exploiting this vulnerability, an attacker could modify the email template for password reset and account confirmation emails.
Vulnerability Detail
The vulnerability in Strapi versions before 3.0.2 stems from the lack of proper input validation for email templates. These templates are stored in a global variable without undergoing any sanitation process. As a result, a remote authenticated attacker can send a specially crafted request to exploit this vulnerability. By doing so, the attacker can update the email template for both password reset and account confirmation emails. This can lead to various security risks, such as phishing attacks or unauthorized access to user accounts.
How To Fix
Latest published version: 3.6.11 as of 22 Oct 2026
npm install strapi@3.6.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.2
This is the first release that contains the fix.
npm install strapi@3.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, until the Strapi version 3.0.2 or later is installed, developers can manually sanitize the email templates before storing them in the global variable. This can be achieved by implementing input validation and sanitization techniques, such as removing potentially malicious content or escaping special characters. Here is an example of how to sanitize the email template using JavaScript:
const sanitizedTemplate = sanitize(template);
Conclusion
In conclusion, Strapi versions before 3.0.2 are vulnerable to an improper input validation issue that allows a remote authenticated attacker to modify email templates. To mitigate this vulnerability, it is crucial to update Strapi to version 3.0.2 or later and ensure proper input validation and sanitization of email templates. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for strapi →
FAQ
Strapi is an open-source headless CMS that allows developers to create, manage, and deploy content-rich websites and applications.
This vulnerability in Strapi versions before 3.0.2 can allow a remote authenticated attacker to modify the email template for password reset and account confirmation emails. This can lead to security risks such as phishing attacks or unauthorized access to user accounts.
To fix this vulnerability, update Strapi to version 3.0.2 or later. Follow the upgrade instructions provided by the Strapi project and ensure that user input used in email templates is properly validated and sanitized.
As a temporary workaround, manually sanitize the email templates before storing them in the global variable. Implement input validation and sanitization techniques to remove potentially malicious content or escape special characters.
For more information about this vulnerability, refer to the CVE-2020-13961 advisory on the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-65wv-528r-m892/GHSA-65wv-528r-m892.json
Related vulnerabilities
Recent vulnerabilities recorded for strapi.
