Command Injection in strapi
Summary
GHSA-9p2w-rmx4-9mw7: Command Injection in strapi. Affects strapi versions < 3.0.0-beta.17.8. Fixed in 3.0.0-beta.17.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Strapi is an open-source headless CMS (Content Management System) built with Node.js. It allows developers to quickly build APIs and manage content for their applications. Strapi provides an admin panel for easy content management and supports various plugins for extended functionality.
Vulnerability Detail
Versions of strapi before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the /admin/plugins/install/ route. This may allow an authenticated attacker with admin privileges to run arbitrary commands on the server. The vulnerability has a severity rating of HIGH (CWE-77).
How To Fix
Latest published version: 3.6.11 as of 22 Oct 2026
npm install strapi@3.6.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0-beta.17.8
This is the first release that contains the fix.
npm install strapi@3.0.0-beta.17.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version to mitigate the risk of command injection.
Conclusion
Command Injection vulnerability in strapi versions before 3.0.0-beta.17.8 allows an authenticated attacker with admin privileges to execute arbitrary commands on the server. It is recommended to upgrade to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for strapi →
FAQ
The vulnerability allows an authenticated attacker with admin privileges to execute arbitrary commands on the server, potentially leading to unauthorized access, data loss, or further compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file to identify any open-source vulnerabilities in your software.
No, only versions before 3.0.0-beta.17.8 are affected. It is recommended to upgrade to the latest version to ensure the vulnerability is patched.
Yes, the attacker needs to have authenticated access with admin privileges to exploit this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is crucial to upgrade to the fixed version to prevent any potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for strapi.
