What’s Vulnerable › Vulnerabilities

CVE-2026-90561: Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

• Severity: high (CVSS 8.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-13 · updated 2026-09-24
• Weakness: CWE-79

Description

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.

Affected products

• strapi: from 4.0.0 through 4.26.2; from 5.0.0 before 5.48.1 — fixed in 5.48.1

How to fix

Upgrade to a fixed version: strapi 5.48.1. Check the vendor advisory for mitigations.

References

• https://github.com/strapi/strapi
• https://github.com/strapi/strapi/blob/v5.46.0/packages/core/content-manager/admin/src/pages/EditView/components/FormInputs/Wysiwyg/PreviewWysiwyg.tsx
• https://github.com/strapi/strapi/commit/875752612c30f951546904a29469e51e17e0ac37
• https://github.com/strapi/strapi/issues/26857
• https://www.vulncheck.com/advisories/strapi-4-x-through-4.26.2-and-5-x-before-5.48.1-stored-xss-via-wysiwyg

Get alerted when CVE-2026-90561 or the next vulnerability affects your stack