CVE-2025-53092
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration
Impact
### Summary A CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses. ### Technical Details By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. Example: `Origin: http://localhost:8888` `Access-Control-Allow-Origin: http://localhost:8888` `Access-Control-Allow-Credentials: true` This allows an attacker-controlled site (on a different port, like 8888) to send credentialed requests to the Strapi backend on 1337. ### Suggested Fix 1. Explicitly whitelist trusted origins 2. Avoid reflecting dynamic origins
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @strapi/core | < 5.20.0 | 5.20.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Strapi | Strapi | before 5.20.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8
- https://github.com/advisories/GHSA-9329-mxxw-qwf8
- https://nvd.nist.gov/vuln/detail/CVE-2025-53092
- https://github.com/strapi/strapi/commit/6e535cb756
- https://github.com/strapi/strapi/releases/tag/v5.20.0