https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T14:53:18.537296+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-15525 cnvd-2022-15525 2026-10-07T14:53:18.541058+00:00 cnvd-2022-15525 https://cve.radiocsirt.org/vuln/euvd-2026-11226 EUVD-2026-11226 2026-10-07T14:53:18.541093+00:00 EUVD-2026-11226 https://cve.radiocsirt.org/vuln/fkie_cve-2022-0764 fkie_cve-2022-0764 2026-10-07T14:53:18.541107+00:00

Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-xrjf-phvv-r4vr GHSA-xrjf-phvv-r4vr — Command injection in strapi 2026-10-07T14:53:18.541135+00:00

Affected: npm: strapi

When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular [link](https://github.com/strapi/strapi/blob/master/packages/generators/app/lib/utils/fetch-npm-template.js#L13), this happens due to improper sanitization of user input.

 https://cve.radiocsirt.org/vuln/gsd-2022-0764 gsd-2022-0764 2026-10-07T14:53:18.541159+00:00 gsd-2022-0764