Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Strapi content preview lets author inject scripts

CVE-2026-90561 · published 27 days ago
Summary

Strapi versions up to 4.26.2 and before 5.48.1 allow a user with author rights to save malicious code in rich‑text fields. When an editor or super‑admin opens the preview pane, that code runs in their browser, potentially letting the attacker take over the account. Update Strapi to the latest release or apply the vendor’s patch to fix the preview handling.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
strapi strapi <= 4.26.2
Original advisory text
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Sep 2026
Updated9 Oct 2026
First seen13 Sep 2026
Sources
CVE-2026-90561 · NVD
CVE-2026-90561 · MITRE
CVE-2026-90561 · OSV
Track software like this
Free during beta