https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T14:16:59.246737+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-01016 cnvd-2020-01016 2026-10-22T14:16:59.270152+00:00 cnvd-2020-01016 https://cve.radiocsirt.org/vuln/euvd-2026-59420 EUVD-2026-59420 2026-10-22T14:16:59.270201+00:00 EUVD-2026-59420 https://cve.radiocsirt.org/vuln/fkie_cve-2019-19609 fkie_cve-2019-19609 2026-10-22T14:16:59.270222+00:00

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

 https://cve.radiocsirt.org/vuln/ghsa-9p2w-rmx4-9mw7 GHSA-9p2w-rmx4-9mw7 — Command Injection in strapi 2026-10-22T14:16:59.270266+00:00

Affected: npm: strapi

Versions of `strapi` before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the `/admin/plugins/install/` route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server.

## Recommendation

Upgrade to version 3.0.0-beta.17.8 or later

 https://cve.radiocsirt.org/vuln/gsd-2019-19609 gsd-2019-19609 2026-10-22T14:16:59.270310+00:00 gsd-2019-19609