| Package | Affected versions | Patched versions |
|---|---|---|
| strapi | < 4.1.0 | 4.1.0 |
| strapi | < 4.1.0 | 4.1.0 |
When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular link, this happens due to improper sanitization of user input.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free