{"id":"GHSA-9329-mxxw-qwf8","revision":"f0c1ce687bda4b6986634e78b41b00be","records":[{"revision":"f0c1ce687bda4b6986634e78b41b00be","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-9329-mxxw-qwf8","aliases":["CVE-2025-53092"],"title":"Strapi core vulnerable to sensitive data exposure via CORS misconfiguration","description":"### Summary\n\nA CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses.\n\n### Technical Details\n\nBy default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting.\n\nExample:\n`Origin: http://localhost:8888`\n`Access-Control-Allow-Origin: http://localhost:8888`\n`Access-Control-Allow-Credentials: true`\n\nThis allows an attacker-controlled site (on a different port, like 8888) to send credentialed requests to the Strapi backend on 1337.\n\n### Suggested Fix\n\n1. Explicitly whitelist trusted origins\n2. Avoid reflecting dynamic origins","state":0,"publishedAt":"2025-10-16T19:49:01+00:00","modifiedAt":"2026-02-03T03:03:57.813541+00:00","affected":[{"ecosystem":"npm","name":"@strapi/core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.20.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8","https://nvd.nist.gov/vuln/detail/CVE-2025-53092","https://github.com/strapi/strapi/commit/6e535cb756","https://github.com/strapi/strapi","https://github.com/strapi/strapi/releases/tag/v5.20.0"],"sourceUrl":"https://github.com/advisories/GHSA-9329-mxxw-qwf8","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9329-mxxw-qwf8","identifiers":["GHSA-9329-mxxw-qwf8","CVE-2025-53092"]},"retained":false,"historicalAffected":[]}],"coverage":[]}