@strapi/strapi
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 10 advisory(ies) without a verdict
Advisories (11)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-4phg-hpqm-c3j4 Strapi mishandles hidden attributes within admin API responses | 4.0.0-next.0 – < 4.1.10 | Undetermined |
| GHSA-4r8w-3jww-m2rp Strapi is vulnerable to Insufficient Session Expiration | < 5.24.1 | Undetermined |
| GHSA-4vm8-j95f-j6v5 Strapi 4.1.12 Cross-site Scripting via crafted file | ≤ 4.1.12 | Undetermined |
| GHSA-85vg-grr5-pw42 Insecure password handling vulnerability in Strapi | 4.0.0 – < 4.1.5 | Undetermined |
| GHSA-chmr-rg2f-9jmf Making all attributes on a content-type public without noticing it | < 4.10.8 | Undetermined |
| GHSA-f6fm-r26q-p747 Improper Removal of Sensitive Information Before Storage or Transfer in Strapi | < 4.0.0-beta.15 | Undetermined |
| GHSA-gc7p-j5xm-xxh2 Unauthorized Access to Private Fields in User Registration API | 4.0.0 – < 4.13.1 | Undetermined |
| GHSA-jjqf-j4w7-92w8 Strapi leaking sensitive user information by filtering on private fields | 3.2.1 – < 4.8.0 | Undetermined |
| GHSA-p9ff-j98v-p435 Strapi Server-Side Request Forgery (SSRF) | 4.24.4 | Not affected |
| GHSA-rjg2-95x7-8qmx Strapi may leak sensitive data via relational filtering due to lack of query sanitization | 4.0.0 – < 5.37.0 | Undetermined |
| GHSA-vgj7-895j-gpr6 Improper Removal of Sensitive Information Before Storage or Transfer in Strapi | < 4.1.9 | Undetermined |
Sources
| Source | Licence |
|---|