CVE-2023-22621
HIGHStrapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Blast Radius
@strapi/plugin-users-permissions📦@strapi/plugin-emailReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.
Description
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @strapi/plugin-users-permissions | all versions | 4.5.6 |
| 📦npm | @strapi/plugin-email | all versions | 4.5.6 |
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Frequently Asked Questions
Is CVE-2023-22621 in your stack?
O3 detects CVE-2023-22621 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.