@strapi/strapi
An open source headless CMS solution to create and manage your own API. It provides a powerful dashboard and features to make your life easier. Databases supported: MySQL, MariaDB, PostgreSQL, SQLite
88%
Total Score
healthy
Active, well-backed project with strong maintenance signals and several workflow-audit concerns.
Health Score Breakdown
No build attestation or trusted-publisher provenance is reported, leaving publication provenance less independently verifiable despite the package's otherwise strong project evidence.
The package has 60 runtime dependencies, which is substantial for a full CMS and increases maintenance surface, but its modular Strapi dependency set is consistent with the package's scope.
All 30 workflows were analyzed successfully, but high-confidence findings include template injection, GitHub App tokens inheriting blanket permissions, and unpinned container images; 5 of 125 action references are also unpinned. No untrusted checkout or script-injection sink was found, limiting this to a caution rather than a severe dependency-health risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-27886 @strapi/strapi is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 4.0.0 - 5.37.0. | 4.0.0 - 5.37.0 | Critical |
CVE-2025-3930 @strapi/strapi is vulnerable to Insufficient Session Expiration in versions 0.0.0 - 5.24.1. | 0.0.0 - 5.24.1 | Medium |
AIKIDO-2025-10134 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @strapi/strapi is vulnerable to Race Condition in versions 4.6.0 - 5.10.4. | 4.6.0 - 5.10.4 | Low |
CVE-2024-37818 @strapi/strapi is vulnerable to Server-Side Request Forgery (SSRF) in versions 4.24.4 - 4.24.4. | 4.24.4 - 4.24.4 | High |
AIKIDO-2024-10092 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @strapi/strapi is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 4.0.0 - 4.24.1. | 4.0.0 - 4.24.1 | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ora Version 5.4.1 | — | — |
yup Version 0.32.9 | — | — |
vite Version 6.4.3 | — | — |
boxen Version 5.1.2 | — | — |
chalk Version 4.1.2 | — | — |
Weekly Downloads
Info
- Last Published
- 5 days ago
- Created
- 5 years ago
- Unpacked Size
- 2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.