---
title: "CVE-2026-22599: Strapi Vulnerable to SQL Injection in Content Type Builder"
url: https://erroneo.us/security/cve/CVE-2026-22599/
description: "CVE-2026-22599 (@strapi/content-type-builder (npm)): Strapi is an open source headless content management system. In versions on the 4.x branch prior to…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-05-14
date_modified: 2026-05-15
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-22599"
kev: false
cvss: 9.3
epss: 0.01178
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-22599: Strapi Vulnerable to SQL Injection in Content Type Builder

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 1.2% , percentile 67: FIRST’s model estimates a 1.2% chance of exploitation activity in the next 30 days, higher than 67% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes @strapi/content-type-builder (npm) >= 5.0.0, < 5.33.2, fixed in 5.33.2 ; @strapi/plugin-content-type-builder (npm) >= 4.0.0, < 4.26.1, fixed in 4.26.1 . Check your lockfile, including transitive dependencies.

## What it is

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the column.defaultTo attribute when creating or modifying a content type. Setting defaultTo as a tuple [value, { isRaw: true }] caused the value to be passed directly into Knex's db.connection.raw() during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server. The patch in versions 4.26.1 and 5.33.2 addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against /content-type-builder/content-types and related endpoints, removing the network-reachable attack surface entirely.

## Affected packages

- npm `@strapi/content-type-builder` >= 5.0.0, < 5.33.2 → fixed: 5.33.2
- npm `@strapi/plugin-content-type-builder` >= 4.0.0, < 4.26.1 → fixed: 4.26.1

## Affected products (CVE record)

- strapi strapi: >= 5.0.0, < 5.33.2, >= 4.0.0, < 4.26.1
- strapi @strapi/content-type-builder: >= 5.0.0, < 5.33.2, >= 4.0.0, < 4.26.1

## Severity

- GitHub_M CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N`
- GitHub CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 1.18% probability of exploitation activity in the next 30 days; percentile 67.

## Sources

- [GitHub Advisory GHSA-3xcq-8mjw-h6mx](https://github.com/advisories/GHSA-3xcq-8mjw-h6mx)
- [CVE.org record CVE-2026-22599](https://www.cve.org/CVERecord?id=CVE-2026-22599)
- [NVD entry CVE-2026-22599](https://nvd.nist.gov/vuln/detail/CVE-2026-22599)
- [github.com](https://github.com/strapi/strapi/security/advisories/GHSA-3xcq-8mjw-h6mx)
- [github.com](https://github.com/strapi/strapi/releases/tag/v4.26.1)
- [github.com](https://github.com/strapi/strapi/releases/tag/v5.33.2)

---
Source page: https://erroneo.us/security/cve/CVE-2026-22599/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt