Paper/Archive/CVE-2026-90561

CVE-2026-90561

strapi strapi — Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 37.3.373 × 207.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.

Affected

ProductAffectedFixed inSource

strapi4.0.0 – 4.26.2–CNA

strapi5.0.0 – < 5.48.15.48.1CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

VulnCheck (CNA)8.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/strapi/strapi/issues/26857 refgithub.com/strapi/strapi writeupgithub.com/strapi/strapi/blob/v5.46.0/packages/core/content-manager/admin/src/pages/EditView/components/FormInputs/Wysiwyg/PreviewWysiwyg.tsx patchgithub.com/strapi/strapi/commit/875752612c30f951546904a29469e51e17e0ac37 writeupvulncheck.com/advisories/strapi-4-x-through-4.26.2-and-5-x-before-5.48.1-stored-xss-via-wysiwyg