Executive brief
Strapi is a popular open-source headless CMS platform used to manage website and application content. This vulnerability allows a user with Author-level permissions to inject malicious scripts into rich text fields that execute when an Editor or Super Admin previews the content, potentially leading to account compromise. An attacker with basic authoring privileges can steal admin credentials or perform unauthorized actions on the platform.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the WYSIWYG preview component (PreviewWysiwyg.tsx) of Strapi's content manager, where script tags in rich text fields are not properly sanitized. An Author-role user can inject malicious JavaScript code into rich text fields that will persist in the database. When an Editor or Super Admin user expands the preview pane, the stored malicious script executes in their authenticated session, allowing session hijacking or account takeover. The vulnerability affects Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1. Patches are available in Strapi 5.48.1 and later.
Affected products
- Strapi Strapi 4.x through 4.26.2, 5.x before 5.48.1
Timeline
- 2026-09-13: disclosed: CVE-2026-90561 published on NVD