Skip to content
Threat Feed

Product

@Strapi/Content-Type-Builder

1 brief RSS
critical advisory

Strapi Content-Type Builder SQL Injection Vulnerability (CVE-2026-22599)

A SQL injection vulnerability, identified as CVE-2026-22599, affects Strapi's Content-Type Builder, where an authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute, potentially leading to arbitrary file read, denial of service, or remote code execution on the database server.

@strapi/content-type-builder +1 sql-injection vulnerability strapi
2r 1t