Read the docs
TI-2019-14129 Aliases CVE-2019-19609GHSA-9p2w-rmx4-9mw7

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the…

Priority MEDIUM 64CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

Why it matters now

EPSS 0.54081 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed strapi (npm): 3.0.0-beta.17.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—strapi (npm)before 3.0.0-beta.17.83.0.0-beta.17.8Patch availableGHSA-9p2w-rmx4-9mw7
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • strapi (npm) Vendor— Affected before 3.0.0-beta.17.8 Fixed in 3.0.0-beta.17.8 Patch available GHSA-9p2w-rmx4-9mw7

CPE configurations NVD · 93

CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*up to 1.6.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:*3.0.0 alpha10.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:*3.0.0 alpha10.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:*3.0.0 alpha10.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:*3.0.0 alpha11VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:*3.0.0 alpha11.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:*3.0.0 alpha11.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:*3.0.0 alpha11.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:*3.0.0 alpha12VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:*3.0.0 alpha12.1VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:* Versions up to 1.6.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:* Versions 3.0.0 alpha10.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:* Versions 3.0.0 alpha10.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:* Versions 3.0.0 alpha10.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:* Versions 3.0.0 alpha11 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:* Versions 3.0.0 alpha11.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:* Versions 3.0.0 alpha11.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:* Versions 3.0.0 alpha11.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:* Versions 3.0.0 alpha12 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:* Versions 3.0.0 alpha12.1 Vulnerable ·Strapi
Show 83 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:*3.0.0 alpha12.1.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:*3.0.0 alpha12.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:*3.0.0 alpha12.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:*3.0.0 alpha12.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:*3.0.0 alpha12.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:*3.0.0 alpha12.6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:*3.0.0 alpha12.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:*3.0.0 alpha12.7.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:*3.0.0 alpha13VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:*3.0.0 alpha13.0.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:*3.0.0 alpha13.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:*3.0.0 alpha14VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:*3.0.0 alpha14.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:*3.0.0 alpha14.1.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:*3.0.0 alpha14.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:*3.0.0 alpha14.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:*3.0.0 alpha14.4.0VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:*3.0.0 alpha14.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:*3.0.0 alpha15VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:*3.0.0 alpha16VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:*3.0.0 alpha17VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:*3.0.0 alpha18VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:*3.0.0 alpha19VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:*3.0.0 alpha20VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:*3.0.0 alpha21VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:*3.0.0 alpha22VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:*3.0.0 alpha23VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:*3.0.0 alpha23.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:*3.0.0 alpha24VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:*3.0.0 alpha24.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:*3.0.0 alpha25VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:*3.0.0 alpha25.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:*3.0.0 alpha25.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:*3.0.0 alpha26VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:*3.0.0 alpha26.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:*3.0.0 alpha26.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:*3.0.0 alpha4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:*3.0.0 alpha4.8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:*3.0.0 alpha5.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:*3.0.0 alpha5.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:*3.0.0 alpha6.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:*3.0.0 alpha6.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:*3.0.0 alpha6.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:*3.0.0 alpha7.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:*3.0.0 alpha7.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:*3.0.0 alpha8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:*3.0.0 alpha8.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:*3.0.0 alpha9VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:*3.0.0 alpha9.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:*3.0.0 alpha9.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:*3.0.0 beta0VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:*3.0.0 beta1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:*3.0.0 beta10VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:*3.0.0 beta11VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:*3.0.0 beta12VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:*3.0.0 beta13VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:*3.0.0 beta14VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:*3.0.0 beta15VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:*3.0.0 beta16VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:*3.0.0 beta16.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:*3.0.0 beta16.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:*3.0.0 beta16.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:*3.0.0 beta16.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:*3.0.0 beta16.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:*3.0.0 beta16.6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:*3.0.0 beta16.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:*3.0.0 beta16.8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:*3.0.0 beta17VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:*3.0.0 beta17.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:*3.0.0 beta17.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:*3.0.0 beta17.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:*3.0.0 beta17.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.5:*:*:*:*:*:*3.0.0 beta17.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.6:*:*:*:*:*:*3.0.0 beta17.6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.7:*:*:*:*:*:*3.0.0 beta17.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:*3.0.0 beta2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:*3.0.0 beta3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:*3.0.0 beta4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:*3.0.0 beta5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:*3.0.0 beta6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:*3.0.0 beta7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:*3.0.0 beta8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:*3.0.0 beta9VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:* Versions 3.0.0 alpha12.1.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:* Versions 3.0.0 alpha12.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:* Versions 3.0.0 alpha12.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:* Versions 3.0.0 alpha12.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:* Versions 3.0.0 alpha12.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:* Versions 3.0.0 alpha12.6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:* Versions 3.0.0 alpha12.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:* Versions 3.0.0 alpha12.7.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:* Versions 3.0.0 alpha13 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:* Versions 3.0.0 alpha13.0.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:* Versions 3.0.0 alpha13.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:* Versions 3.0.0 alpha14 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:* Versions 3.0.0 alpha14.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:* Versions 3.0.0 alpha14.1.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:* Versions 3.0.0 alpha14.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:* Versions 3.0.0 alpha14.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:* Versions 3.0.0 alpha14.4.0 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:* Versions 3.0.0 alpha14.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:* Versions 3.0.0 alpha15 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:* Versions 3.0.0 alpha16 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:* Versions 3.0.0 alpha17 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:* Versions 3.0.0 alpha18 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:* Versions 3.0.0 alpha19 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:* Versions 3.0.0 alpha20 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:* Versions 3.0.0 alpha21 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:* Versions 3.0.0 alpha22 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:* Versions 3.0.0 alpha23 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:* Versions 3.0.0 alpha23.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:* Versions 3.0.0 alpha24 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:* Versions 3.0.0 alpha24.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:* Versions 3.0.0 alpha25 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:* Versions 3.0.0 alpha25.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:* Versions 3.0.0 alpha25.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:* Versions 3.0.0 alpha26 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:* Versions 3.0.0 alpha26.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:* Versions 3.0.0 alpha26.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:* Versions 3.0.0 alpha4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:* Versions 3.0.0 alpha4.8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:* Versions 3.0.0 alpha5.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:* Versions 3.0.0 alpha5.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:* Versions 3.0.0 alpha6.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:* Versions 3.0.0 alpha6.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:* Versions 3.0.0 alpha6.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:* Versions 3.0.0 alpha7.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:* Versions 3.0.0 alpha7.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:* Versions 3.0.0 alpha8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:* Versions 3.0.0 alpha8.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:* Versions 3.0.0 alpha9 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:* Versions 3.0.0 alpha9.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:* Versions 3.0.0 alpha9.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:* Versions 3.0.0 beta0 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:* Versions 3.0.0 beta10 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:* Versions 3.0.0 beta11 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:* Versions 3.0.0 beta12 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:* Versions 3.0.0 beta13 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:* Versions 3.0.0 beta14 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:* Versions 3.0.0 beta15 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:* Versions 3.0.0 beta16 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:* Versions 3.0.0 beta16.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:* Versions 3.0.0 beta16.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:* Versions 3.0.0 beta16.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:* Versions 3.0.0 beta16.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:* Versions 3.0.0 beta16.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:* Versions 3.0.0 beta16.6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:* Versions 3.0.0 beta16.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:* Versions 3.0.0 beta16.8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:* Versions 3.0.0 beta17 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:* Versions 3.0.0 beta17.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:* Versions 3.0.0 beta17.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:* Versions 3.0.0 beta17.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:* Versions 3.0.0 beta17.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.5:*:*:*:*:*:* Versions 3.0.0 beta17.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.6:*:*:*:*:*:* Versions 3.0.0 beta17.6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.7:*:*:*:*:*:* Versions 3.0.0 beta17.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:* Versions 3.0.0 beta3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:* Versions 3.0.0 beta4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:* Versions 3.0.0 beta5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:* Versions 3.0.0 beta6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:* Versions 3.0.0 beta7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:* Versions 3.0.0 beta8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:* Versions 3.0.0 beta9 Vulnerable ·Strapi

Remediation

  • Fix · GHSA-9p2w-rmx4-9mw7 strapi (npm) Fixed in 3.0.0-beta.17.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19609
  2. 2026-10-03 Alias added: GHSA-9p2w-rmx4-9mw7
  3. 2026-10-19 EPSS moved to the 99th percentile and above
  4. 2026-10-25 EPSS moved to the 95th–99th percentile
  5. 2026-10-27 EPSS moved to the 99th percentile and above

References

Exploit 3

Patch 1

Advisory 1

Other 3

  • TI-2023-09037 Query filter flaw in Strapi exposes sensitive user details KEVCVSS 3.1HIGH 7.2
  • TI-2019-13554 strapi before 3.0.0-beta.17.5 mishandles password resets within… CVSS 3.1CRITICAL 9.8
  • TI-2023-19887 Strapi Improper Rate Limiting vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-08803 Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can… CVSS 3.1CRITICAL 10.0
  • TI-2024-25161 Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 8.6
  • TI-2023-17071 Leaking sensitive user information still possible by filtering on private with prefix fields CVSS 3.1HIGH 8.6
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences