strapi @strapi/database vulnerabilities

Latest strapi @strapi/database CVEs

Newest publication first

1. CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

   Published 2023-07-25

   High·CVSS 7.5

   Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the t(number) prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it...

2. CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it

   Published 2023-07-25

   High·CVSS 7.1

   Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.