@strapi/core (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package @strapi/core, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2024-56143 — CVSS 8.2 (high): Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the…
• CVE-2025-53092 — CVSS 6.5 (medium): Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability…
• CVE-2025-25298 — CVSS 5.3 (medium): Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using…