@strapi/admin (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package @strapi/admin, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2023-38507 — CVSS 7.3 (high): Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of…
• CVE-2026-22706 — CVSS 6.5 (medium): Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password…
• CVE-2023-36472 — CVSS 5.8 (medium): Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset…
• CVE-2024-52588 — CVSS 4.9 (medium): Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to…