CMS

strapi/strapi

🚀 Strapi is the leading open-source headless CMS. It’s 100% JavaScript/TypeScript, fully customizable, and developer-first.

#strapi#nodejs#api#dashboard#javascript#graphql#rest#cms#headless-cms#jamstack#customizable#hacktoberfest#mysql#content-management#cms-framework#content-management-system#typescript#no-code#posgresql

スコア

/ 100

Star

72,185

Fork

9,712

Open Issue

488

サイズ

620MB

言語

TypeScript ★

最終push

0 日前

Docker

—

採点内訳

過去CVE 20件 (やや多い)

✓

直近 push: 1 日前

✓

得意言語 (TypeScript)

✓

オープンissue 488件

✓

超大規模 (0.6GB)

—

Docker 未対応

—

50k–100k: 上級 (★72,185)

—

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (20 件)

CRITICALGHSA-rjg2-95x7-8qmx CVE-2026-278862026/5/13
Leaking sensitive data via relational filtering due to lack of query sanitization
MEDIUMGHSA-pcw7-5633-82vv CVE-2026-227072026/5/13
Upload Plugin MIME Validation Bypass via Content API
MEDIUMGHSA-7mqx-wwh4-f9fw CVE-2025-645262026/5/13
Rate limit bypass on auth routes due to invalid prefix checking
LOWGHSA-hvp3-26wx-g2w4 CVE-2026-227062026/5/13
Password Reset Does Not Revoke Existing Refresh Sessions
CRITICALGHSA-3xcq-8mjw-h6mx CVE-2026-225992026/5/13
SQL Injection in Content Type Builder
HIGHGHSA-495j-h493-42q2 CVE-2024-561432025/10/16
Unauthorized Access to Private Fields via parms.lookup
LOWGHSA-2cjv-6wg9-f4f3 CVE-2025-252982025/10/16
Weak Password Length Validation
HIGHGHSA-9329-mxxw-qwf8 CVE-2025-530922025/10/16
CORS Misconfiguration Leads to Sensitive Data Exposure
MEDIUMGHSA-v8wj-f5c7-pvxf CVE-2024-525882025/5/27
Server - Side Request Forgery in Webhook function
HIGHGHSA-wrvh-rcmr-9qfc CVE-2024-340652024/6/12
3rd party token leak and authentication bypass
MEDIUMGHSA-pm9q-xj9p-96pm CVE-2024-312172024/6/12
Denial-of-Service via Improper Exception Handling
LOWGHSA-6j89-frxc-q26m CVE-2024-291812024/6/12
Leaking data via relations via the Admin Panel
HIGHGHSA-gc7p-j5xm-xxh2 CVE-2023-393452023/11/3
Unauthorized Access to Private Fields in User Registration API
LOWGHSA-m284-85mf-cgrc CVE-2023-372632023/9/13
Field level permissions not being respected in relationship title
MEDIUMGHSA-v8gg-4mq2-88q4 CVE-2023-364722023/9/13
Leaking sensitive user information, user reset password, tokens via content-manager views
HIGHGHSA-24q2-59hm-rh9r CVE-2023-385072023/9/13
Improper Rate Limiting
HIGHGHSA-9xg4-3qfm-9w8f CVE-2023-342352023/7/25
Leaking sensitive user information still possible by filtering on private with prefix fields
MEDIUMGHSA-chmr-rg2f-9jmf CVE-2023-340932023/7/25
Making all attributes on a content-type public via review workflows
CRITICALGHSA-2h87-4q2w-v4hf CVE-2023-226212023/4/18
SSTI to RCE in the Users-Permissions Plugin
HIGHGHSA-xv3q-jrmm-4fxv CVE-2023-228932023/4/18
Authentication Bypass for AWS Cognito Login Provider