CVE-2026-90561 strapi CVE debrief

Who should care

Strapi instance administrators and users with access to the content manager WYSIWYG preview component should assess exposure and take remediation steps. This includes reviewing and updating Strapi instances to version 5.48.1 or later, restricting access to the content manager WYSIWYG preview component, and monitoring for suspicious activity in Strapi instances. Additionally, users with access to the content manager WYSIWYG preview component should be aware

Why it matters

CVE-2026-90561 is a critical stored cross-site scripting vulnerability in Strapi instances, allowing malicious script execution in certain user sessions. Strapi administrators and users with access to the content manager WYSIWYG preview component should assess exposure and prioritize remediation.

• Account takeover via stored cross-site scripting
• Potential for malicious script execution in Editor or Super Admin sessions
• Need for verification of Strapi instance vulnerability and exposure

Technical summary

The Strapi content manager WYSIWYG preview component fails to strip script tags from rich text, allowing an Author-role user to store malicious script tags that execute in an Editor or Super Admin's session when the preview pane is expanded. This vulnerability enables account takeover via stored cross-site scripting and potential for malicious script execution in Editor or Super Admin sessions. The vulnerability affects Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1. To mitigate the vulnerability, administrators should review and update Strapi instances to version 5.48.1 or later.

Defensive priority

High

Recommended defensive actions

• Review and update Strapi instances to version 5.48.1 or later
• Restrict access to the content manager WYSIWYG preview component
• Monitor for suspicious activity in Strapi instances
• Implement additional logging and monitoring for Strapi instances
• Verify the integrity of Strapi instance data
• Conduct a thorough review of Strapi instance configurations
• Ensure that all users with access to the content manager WYSIWYG preview component are aware of the vulnerability and its potential impacts

Evidence notes

The CVE record and NVD entry provide details on the stored cross-site scripting vulnerability in Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded. The vulnerability allows for account takeover via stored cross-site scripting and potential for malicious script execution in Editor or Super Admin sessions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.