npm/@strapi/plugin-content-type-builder CVE-2026-22599: critical, EPSS 1.18%
Strapi Vulnerable to SQL Injection in Content Type Builder
Action: Upgrade @strapi/plugin-content-type-builder to 4.26.1 or later.
npm i @strapi/plugin-content-type-builder@4.26.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.26.1 | - |
Fixed versions
| 4.26.1 |
Sources
- osv: GHSA-3xcq-8mjw-h6mx#npm/@strapi/plugin-content-type-builder
- https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx
- https://nvd.nist.gov/vuln/detail/CVE-2026-22599
- https://github.com/strapi/strapi
- https://github.com/strapi/strapi/releases/tag/v4.26.1
- https://github.com/strapi/strapi/releases/tag/v5.33.2
CVE-2026-22599 · published · modified · JSON