Description
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
Recommendation
Update the @strapi/strapi package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.0.0-next.0, < 4.1.10
- Patched version(s): 4.1.10
References
Related Issues
- Strapi 4.1.12 Cross-site Scripting via crafted file - CVE-2022-32114
- Improper Removal of Sensitive Information Before Storage or Transfer in Strapi - CVE-2022-30618
- Improper Removal of Sensitive Information Before Storage or Transfer in Strapi - @strapi/strapi - CVE-2022-30617
- Strapi may leak sensitive data via relational filtering due to lack of query sanitization - CVE-2026-27886
You might also like:
- Tags:
- npm
- @strapi/strapi
Anything's wrong? Let us know Last updated on February 02, 2023