# CVE-2022-0764: Strapi command injection in app creation

Source: https://junglewise.ai/threats/cve-2022-0764-strapi-command-injection-in-app-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-0764 · Severity: low · CVSS 3 · Published 2022-02-27

Strapi is a headless CMS framework used to build content management systems. When creating a new Strapi application using the command-line tool, attackers can inject arbitrary shell commands through the template argument, potentially leading to unauthorized code execution during the setup process. An attacker would need local access or the ability to control the app creation parameters.

Technologies: [strapi (npm)](https://junglewise.ai/threats/technologies/strapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-0764 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-0764 being exploited in the wild.

**How severe is CVE-2022-0764?** Low severity, with a CVSS score of 3, published 27 February 2022.

**Which products and versions are affected?** strapi (npm) SEMVER:introduced=0,fixed=4.1.0.

**Is there a fix for CVE-2022-0764?** Yes. strapi (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-0764 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2022-0764?** Check whether you run strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- strapi (npm): upgrade to 4.1.0 or later

  ```sh
  npm install strapi@4.1.0
  ```


## Technical details

This vulnerability is a command injection flaw (CWE-77/CWE-78) in the Strapi app generator, specifically in the fetch-npm-template.js file used by `npx create-strapi-app`. The vulnerability stems from improper sanitization of the `--template` command-line argument, which is passed unsanitized to shell execution. An attacker with the ability to influence the app creation command (local access or via a deployment pipeline accepting user input) can inject arbitrary commands that execute with the privileges of the user running the `create-strapi-app` command. The vulnerability affects all versions prior to Strapi 4.1.0; v4 received a fix in commit 2a3f5e9, though v3 versions were not patched.

## Affected products

- Strapi Strapi < 4.1.0

## Identifiers

- CVE-2022-0764
- GHSA-xrjf-phvv-r4vr

## Timeline

- 2022-02-26: disclosed
- 2022: patched: Fixed in Strapi 4.1.0; v3 versions were not patched

## References

- [https://github.com/strapi/strapi/issues/12879](https://github.com/strapi/strapi/issues/12879)

## Related threats

- [Strapi information disclosure via hidden attributes in admin API](https://junglewise.ai/threats/cve-2022-31367-strapi-information-disclosure-via-hidden-attributes-in-admin-api)
- [Strapi stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2022-29894-strapi-stored-cross-site-scripting-in-file-upload)
- [Strapi improper input validation in email templates](https://junglewise.ai/threats/cve-2020-13961-strapi-improper-input-validation-in-email-templates)
- [Strapi sensitive information disclosure in admin panel](https://junglewise.ai/threats/cve-2022-30618-strapi-sensitive-information-disclosure-in-admin-panel)
- [Strapi sensitive information disclosure in admin responses](https://junglewise.ai/threats/cve-2022-30617-strapi-sensitive-information-disclosure-in-admin-responses)