CVE-2026-90561: Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Strapi content manager WYSIWYG previewto a version that resolves this vulnerability.Fixed in 4.26.2 - Upgrade
Upgrade
Strapi content manager WYSIWYG previewto a version that resolves this vulnerability.Fixed in 5.48.1
Event History
Frequently Asked Questions
Which users can exploit this, and which users are targeted?
An authenticated user with the Author role can store malicious script tags in rich text fields. The script executes when an Editor or Super Admin expands the WYSIWYG preview pane.
What interaction is required for exploitation?
The attacker must be able to submit content to a rich text field, and a higher-privileged user must expand the preview pane for that content. The issue is stored XSS, so the payload can persist until the preview is opened.
What is the likely impact after successful exploitation?
Script execution occurs in the Editor or Super Admin's session and can enable account takeover. The vulnerability affects confidentiality and integrity, while no availability impact is indicated.
How can I determine whether an instance is affected?
Instances running Strapi 4.x through 4.26.2 or Strapi 5.x before 5.48.1 are affected if Authors can use rich text fields and privileged users use the content manager WYSIWYG preview. Strapi 5.48.1 is not listed as affected.