PT-2026-90832

CVE-2026-90561

Published

2026-09-13

Updated

2026-09-18

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Strapi versions 4.x through 4.26.2 Strapi versions prior to 5.48.1

Description A stored cross-site scripting issue exists in the content manager WYSIWYG preview component due to a failure to strip script tags from rich text. A user with the Author role can inject malicious script tags into rich text fields. These scripts execute within the session of an Editor or Super Admin when the preview pane is expanded, which can lead to account takeover.

Recommendations Update Strapi versions 4.x through 4.26.2 to version 4.26.3. Update Strapi versions prior to 5.48.1 to version 5.48.1.

Exploitability

Exploit

Fix

Impacts

Researchers

George Chen

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers