{"action":"Upgrade @strapi/plugin-content-type-builder to 4.26.1 or later.","affected":[{"fixed":"4.26.1","introduced":"4.0.0"}],"component":"@strapi/plugin-content-type-builder","cve_ids":["CVE-2026-22599"],"ecosystem":"npm","epss":0.01178,"exploited":false,"fixed_versions":["4.26.1"],"ghsa_id":"GHSA-3xcq-8mjw-h6mx","id":"tcs_01M5KEYMT3397F4GKWA90BH4EW","modified_at":"2026-05-16T00:09:03.616088Z","published_at":"2026-05-13T20:02:36Z","references":["https://osv.dev/vulnerability/GHSA-3xcq-8mjw-h6mx","https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx","https://nvd.nist.gov/vuln/detail/CVE-2026-22599","https://github.com/strapi/strapi","https://github.com/strapi/strapi/releases/tag/v4.26.1","https://github.com/strapi/strapi/releases/tag/v5.33.2"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-3xcq-8mjw-h6mx#npm/@strapi/plugin-content-type-builder","url":"https://osv.dev/vulnerability/GHSA-3xcq-8mjw-h6mx"},{"source":"nvd","source_id":"CVE-2026-22599","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22599"}],"summary":"Strapi Vulnerable to SQL Injection in Content Type Builder"}