Detections
Analytics

SCA: security update for @strapi/content-type-builder, @strapi/plugin-content-type-builder (GHSA-3xcq-8mjw-h6mx)

critical Tenable Self-Hosted Container Security Plugin ID 441827

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1
 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi
 Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements
 through the `column.defaultTo` attribute when creating or modifying a content type. Setting `defaultTo` as
 a tuple `[value, { isRaw: true }]` caused the value to be passed directly into Knex's
 `db.connection.raw()` during schema migration without sanitization, allowing arbitrary statement execution
 at the database layer. Depending on the database engine, this enabled arbitrary file read via database
 utility functions, denial of service via forced server crash on schema-migration error, and on engines
 that permit external program execution, remote code execution against the database server. The patch in
 versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to
 development mode only. Production deployments running v5.33.2 or later return 404 for requests against
 `/content-type-builder/content-types` and related endpoints, removing the network-reachable attack surface
 entirely. (CVE-2026-22599)

Solution

Update the @strapi/plugin-content-type-builder library and its related packages to version 4.26.1 or later.

See Also

https://github.com/advisories/GHSA-3xcq-8mjw-h6mx

Plugin Details

Severity: Critical

ID: 441827

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 5/14/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.87

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-22599

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 7.3

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/13/2026

Vulnerability Publication Date: 5/13/2026

Reference Information

CVE: CVE-2026-22599

cwe: CWE-89