CVE-2020-27666: Cross-site Scripting in Strapi
Summary
CVE-2020-27666: Cross-site Scripting in Strapi. Affects strapi-plugin-content-manager versions < 3.2.5. Fixed in 3.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Strapi is an open-source headless CMS (Content Management System) that enables developers to build powerful and customizable APIs quickly. It provides a user-friendly interface for managing content and comes with various plugins to extend its functionality. The 'strapi-plugin-content-manager' package is a core plugin in Strapi that allows users to create and manage content. However, this package is vulnerable to a stored cross-site scripting (XSS) attack in the wysiwyg editor's preview feature.
Vulnerability Detail
The stored XSS vulnerability in Strapi's 'strapi-plugin-content-manager' package allows an attacker to inject malicious scripts into the wysiwyg editor's preview feature. This can occur when user-generated content is not properly sanitized before being displayed to other users. If a user views the preview of the content containing the injected script, the script will execute in the context of the victim's browser, potentially leading to unauthorized actions, data theft, or further exploitation of the user's session. The vulnerability has been assigned a severity rating of HIGH and is classified under CWE-79.
How To Fix
Latest published version: 3.6.11 as of 22 Oct 2026
npm install strapi-plugin-content-manager@3.6.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.5
This is the first release that contains the fix.
npm install strapi-plugin-content-manager@3.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the wysiwyg editor's preview feature or restrict access to it until the package is updated. This can be done by modifying the configuration settings of the 'strapi-plugin-content-manager' package. Here is an example of how to disable the preview feature:
// config/plugins.js
module.exports = ({ env }) => ({
// ...
'content-manager': {
// ...
wysiwyg: {
// ...
enablePreview: false,
},
},
// ...
});
Conclusion
In conclusion, the 'strapi-plugin-content-manager' package in Strapi versions prior to 3.2.5 is vulnerable to stored XSS. This can allow an attacker to execute malicious scripts in the context of a victim's browser, potentially leading to unauthorized actions, data theft, or further exploitation. To mitigate this vulnerability, it is crucial to update to Strapi version 3.2.5 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for strapi-plugin-content-manager →
FAQ
The stored XSS vulnerability in Strapi's 'strapi-plugin-content-manager' package can allow an attacker to execute arbitrary scripts in the context of a victim's browser. This can lead to unauthorized actions, data theft, or further exploitation of the user's session.
No, only versions prior to 3.2.5 of the 'strapi-plugin-content-manager' package are affected. It is recommended to update to the latest version to mitigate the vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended patch or upgrade to the latest version to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can inject malicious scripts into user-generated content, which will then be executed when other users view the preview of that content.
Yes, the Strapi team has addressed this vulnerability in version 3.2.5 of the 'strapi-plugin-content-manager' package. It is strongly recommended to update to this version or later to ensure the security of your Strapi installation.
