← All advisories

Medium severity6.7NVD Advisory· Published Feb 26, 2022· Updated Jun 17, 2026

CVE-2022-0764

CVE-2022-0764

Description

Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
strapinpm	< 4.1.0	4.1.0

Affected products

3

ghsa-coords
pkg:npm/strapi
Range: < 4.1.0
Strapi/Strapicpe-rescue2 versions
unspecified+ 1 more
- (no CPE)range: unspecified
- cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*range: <4.1.0

Patches

Vulnerability mechanics

References

7

github.com/strapi/strapi/commit/2a3f5e988be6a2c7dae5ac22b9e86d579b462f4cnvdPatchThird Party AdvisoryWEB
huntr.dev/bounties/001d1c29-805a-4035-93bb-71a0e81da3e5nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-xrjf-phvv-r4vrghsaADVISORY
github.com/strapi/strapi/issues/12879nvdIssue TrackingThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-0764ghsaADVISORY
github.com/strapi/strapi/blob/master/packages/generators/app/lib/utils/fetch-npm-template.jsghsaWEB
www.github.com/strapi/strapi/commit/2a3f5e988be6a2c7dae5ac22b9e86d579b462f4cghsaWEB

News mentions

0

No linked articles in our index yet.