p PatchFirst

PatchFirst · Latest vulnerabilities

@strapi/plugin-email vulnerabilities

Vulnerabilities published for @strapi/plugin-email in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2023-22621

    Critical · CVSS 10EPSS 70.6%Public exploitFix available

    CVE-2023-22621

    Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.

    @strapi/plugin-emailNode.js
    • Update to 4.5.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →