GitHub Advisoryadvisory · npm

GHSA-9329-mxxw-qwf8 Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

HIGH Published 2025-10-16 Modified 2026-01-29 Official page ↗
Aliases
CVE-2025-53092
Ecosystem
npm
Packages
@strapi/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-284, CWE-364, CWE-942
Reviewed
2025-10-16

Affected packages

• npm @strapi/core: < 5.20.0 → fixed in 5.20.0

Description

Summary A CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses. Technical Details By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. Example: `Origin: http://localhost:8888` `Access-Control-Allow-Origin: http://localhost:8888` `Access-Control-Allow-Credentials: true` This allows an attacker-controlled site (on a different port, like 8888) to send credentialed requests to the Strapi backend on 1337. Suggested Fix 1. Explicitly whitelist trusted origins 2. Avoid reflecting dynamic origins

Related

Alias · CVE (1)

  • CVE-2025-53092 Strapi is an open source headless content management system. vulnerability

Weakness · CWE (4)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-284 Improper Access Control weakness
  • CWE-364 Signal Handler Race Condition weakness
  • CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains weakness

References