@strapi/core
Core of Strapi
86%
Total Score
healthy
Active, well-backed project with strong maintenance signals but several high-confidence workflow hygiene findings.
Health Score Breakdown
No build attestation or trusted-publisher identity is present, leaving release provenance less transparent than it could be, though this is not evidence of a defective release.
The package declares 59 runtime dependencies and 25 development dependencies, a substantial dependency surface that increases maintenance complexity for a core framework package.
Version 5.58.0 is a stable major release and not a prerelease, although the recent prerelease share is high at 90%, which adds some release-channel uncertainty.
All 30 workflows were analyzed, but high-confidence findings include template injection in a pull_request_target workflow, blanket GitHub App token permissions, and unpinned latest container images. These are meaningful automation supply-chain hygiene risks, though no untrusted checkout or script injection was detected.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10357 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @strapi/core is vulnerable to Protection Mechanism Failure in versions 3.0.0 - 5.38.1. | 3.0.0 - 5.38.1 | Medium |
AIKIDO-2026-10088 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @strapi/core is vulnerable to Improper Access Control in versions 4.0.0 - 5.33.1. | 4.0.0 - 5.33.1 | High |
AIKIDO-2026-10066 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @strapi/core is vulnerable to Insufficient Session Expiration in versions 1.0.0 - 5.33.2. | 1.0.0 - 5.33.2 | Low |
CVE-2025-53092 @strapi/core is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.0 - 5.20.0. | 0.0.0 - 5.20.0 | High |
CVE-2025-25298 @strapi/core is vulnerable to Weak Encoding for Password in versions 0.0.0 - 5.10.3. | 0.0.0 - 5.10.3 | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 qs Version 6.16.0 | — | — |
koa Version 2.16.4 | — | — |
ora Version 5.4.1 | — | — |
yup Version 0.32.9 | — | — |
zod Version 4.4.3 | — | — |
Weekly Downloads
Info
- Last Published
- 16 hours ago
- Created
- 2 years ago
- Unpacked Size
- 5.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.