Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

Description

A CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses.

Recommendation

Update the @strapi/core package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.20.0
• Patched version(s): 5.20.0

References

• GHSA-9329-mxxw-qwf8
• CVE-2025-53092
• CWE-200
• CWE-284
• CWE-364
• CWE-942
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A5
• OWASP 2021-A6

Related Issues

• Strapi Password Hashing is Missing Maximum Password Length Validation - CVE-2025-25298
• Strapi Allows Unauthorized Access to Private Fields via parms.lookup - CVE-2024-56143
• Webrecorder packages are vulnerable to XSS through 404 error handling logic - CVE-2025-58765
• HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit - Vulnerability

Tags:

npm

@strapi/core