CVE-2026-22599

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22599", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T21:50:39.533Z", "datePublished": "2026-05-14T18:35:57.661Z", "dateUpdated": "2026-05-14T19:45:29.894Z"}, "containers": {"cna": {"title": "Strapi Vulnerable to SQL Injection in Content Type Builder", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx"}, {"name": "https://github.com/strapi/strapi/releases/tag/v4.26.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/strapi/strapi/releases/tag/v4.26.1"}, {"name": "https://github.com/strapi/strapi/releases/tag/v5.33.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/strapi/strapi/releases/tag/v5.33.2"}], "affected": [{"vendor": "strapi", "product": "strapi", "versions": [{"version": ">= 5.0.0, < 5.33.2", "status": "affected"}, {"version": ">= 4.0.0, < 4.26.1", "status": "affected"}]}, {"vendor": "strapi", "product": "@strapi/content-type-builder", "versions": [{"version": ">= 5.0.0, < 5.33.2", "status": "affected"}, {"version": ">= 4.0.0, < 4.26.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T18:35:57.661Z"}, "descriptions": [{"lang": "en", "value": "Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely."}], "source": {"advisory": "GHSA-3xcq-8mjw-h6mx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T19:45:08.219015Z", "id": "CVE-2026-22599", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T19:45:29.894Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T19:45:08.219015Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T19:45:13.982Z"}}], "cna": {"title": "Strapi Vulnerable to SQL Injection in Content Type Builder", "source": {"advisory": "GHSA-3xcq-8mjw-h6mx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "strapi", "product": "strapi", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.33.2"}, {"status": "affected", "version": ">= 4.0.0, < 4.26.1"}]}, {"vendor": "strapi", "product": "@strapi/content-type-builder", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.33.2"}, {"status": "affected", "version": ">= 4.0.0, < 4.26.1"}]}], "references": [{"url": "https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx", "name": "https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/strapi/strapi/releases/tag/v4.26.1", "name": "https://github.com/strapi/strapi/releases/tag/v4.26.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/strapi/strapi/releases/tag/v5.33.2", "name": "https://github.com/strapi/strapi/releases/tag/v5.33.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T18:35:57.661Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22599", "state": "PUBLISHED", "dateUpdated": "2026-05-14T19:45:29.894Z", "dateReserved": "2026-01-07T21:50:39.533Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-14T18:35:57.661Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "strapi", "vendor": "strapi", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.33.2"}, {"status": "affected", "version": ">= 4.0.0, < 4.26.1"}]}, {"product": "@strapi/content-type-builder", "vendor": "strapi", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.33.2"}, {"status": "affected", "version": ">= 4.0.0, < 4.26.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "7D0EA7AE-CBE1-4382-935D-DD7AE91C5C8B", "versionEndExcluding": "4.26.1", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "2FB05E59-6F7E-4607-8ECD-6E529C30F1DA", "versionEndExcluding": "5.33.2", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface entirely."}, {"lang": "es", "value": "Strapi es un sistema de gesti\u00f3n de contenido headless de c\u00f3digo abierto. En versiones de la rama 4.x anteriores a la 4.26.1 y de la rama 5.x anteriores a la 5.33.2, exist\u00eda una vulnerabilidad de inyecci\u00f3n de consultas de base de datos en la API de escritura del Content-Type Builder de Strapi. Un administrador autenticado pod\u00eda inyectar sentencias de base de datos arbitrarias a trav\u00e9s del atributo \u2019column.defaultTo\u2019 al crear o modificar un tipo de contenido. Establecer \u2019defaultTo\u2019 como una tupla \u2019[value, { isRaw: true }]\u2019 hac\u00eda que el valor se pasara directamente a \u2019db.connection.raw()\u2019 de Knex durante la migraci\u00f3n del esquema sin sanitizaci\u00f3n, permitiendo la ejecuci\u00f3n de sentencias arbitrarias en la capa de base de datos. Dependiendo del motor de base de datos, esto permit\u00eda la lectura arbitraria de archivos a trav\u00e9s de funciones de utilidad de base de datos, la denegaci\u00f3n de servicio a trav\u00e9s de un fallo forzado del servidor por error de migraci\u00f3n de esquema, y en motores que permiten la ejecuci\u00f3n de programas externos, la ejecuci\u00f3n remota de c\u00f3digo contra el servidor de base de datos. El parche en las versiones 4.26.1 y 5.33.2 aborda esto restringiendo todas las APIs de escritura del Content-Type Builder solo al modo de desarrollo. Las implementaciones de producci\u00f3n que ejecutan la v5.33.2 o posterior devuelven 404 para las solicitudes contra \u2019/content-type-builder/content-types\u2019 y los puntos finales relacionados, eliminando por completo la superficie de ataque alcanzable por red."}], "id": "CVE-2026-22599", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22599", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T19:45:08.219015Z", "version": "2.0.3"}}]}, "published": "2026-05-14T19:16:29.650", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Product"], "url": "https://github.com/strapi/strapi/releases/tag/v4.26.1"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Product"], "url": "https://github.com/strapi/strapi/releases/tag/v5.33.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.33.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.26.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "@strapi/content-type-builder", "source": "cna", "vendor": "strapi"}, "product": "content-type-builder", "vendor": "strapi"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.33.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.26.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "strapi", "source": "cna", "vendor": "strapi"}, "product": "strapi", "vendor": "strapi"}], "created": "2026-05-14T20:30:04.131341+00:00", "updated": "2026-06-18T04:15:15.965267+00:00", "vendors": ["strapi", "strapi$PRODUCT$content-type-builder", "strapi$PRODUCT$strapi"]}