Description

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-13T11:17:00.613Z",
  "pubdate": "2026-09-13T11:17:00.613Z",
  "executiveSummary": "A critical stored Cross-Site Scripting (XSS) vulnerability exists within the Strapi Content Manager's WYSIWYG preview component. The vulnerability arises from an improper sanitization mechanism that fails to neutralize malicious script tags embedded within rich text fields.\nThis flaw allows an authenticated user with 'Author' privileges to inject and store arbitrary JavaScript payloads within the content database. These payloads are subsequently rendered and executed within the security context of privileged users, such as 'Editors' or 'Super Admins', when they interact with the WYSIWYG preview interface.\nSuccessful exploitation leads to unauthorized code execution within the victim's session, enabling actions including unauthorized data access, administrative configuration changes, and complete account takeover. The vulnerability affects Strapi versions 4.x through 4.26.2 and 5.x prior to 5.48.1. Given the potential for privilege escalation and session hijacking, this flaw represents a significant risk to the integrity and confidentiality of the Strapi administrative environment.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate input validation and output encoding process within the Strapi Content Manager's WYSIWYG preview component. Specifically, the system fails to apply rigorous sanitization policies to content rendered in the preview pane, allowing raw HTML tags—most notably <script> tags—to pass through the rendering pipeline without modification.\nThe attack flow begins when an attacker, authenticated as an Author, creates or updates a content entry containing a rich text field. The attacker injects a malicious payload, such as a JavaScript execution string, directly into the field data via the Strapi API or administrative dashboard. Because the application logic does not sanitize these fields during the save process, the malicious payload is stored persistently in the database.\nThe exploitation triggers when a more privileged user (e.g., Editor or Super Admin) accesses the Content Manager to view or edit the affected entry. When the victim selects the entry, the administrative interface invokes the WYSIWYG preview component to render the stored content. During this rendering process, the browser interprets the unsanitized script tags embedded by the attacker as valid, executable code rather than plain text.\nSince the script executes within the security context of the victim's active administrative session, it inherits the victim's session tokens and authentication permissions. This allows the payload to perform arbitrary operations on behalf of the victim, such as modifying user account details, creating new administrative accounts, or exfiltrating sensitive session cookies or CSRF tokens via external network requests.\nThe vulnerability is explicitly identified in Strapi versions 4.x through 4.26.2 and version 5.x before 5.48.1. The attack requires low complexity, as it relies on the standard functionality of the Content Manager, and necessitates authentication as a user with at least 'Author' permissions. As the victim's browser performs the execution of the payload, the exploitation is highly effective at bypassing traditional network-level perimeter defenses that do not inspect the contents of administrative API payloads.\nPost-exploitation impact is severe, as the attacker can manipulate the state of the Strapi application by leveraging the administrative privileges of the targeted victim, effectively escalating their own permissions or compromising the entire application backend."
}