CVE-2025-53092
Description
Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.
How to fix
- strapi strapi5.20.0 or later
- @strapi/core5.20.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| strapi strapi | v < 5.20.0 | 5.20.0 |
| @strapi/corenpm | v < 5.20.0 | 5.20.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.