Summary
Strapi Vulnerable to SQL Injection in Content Type Builder
Summary of CVE-2026-22599 Vulnerability Details
- CVE: CVE-2026-22599
- CVSS v3.1 Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N(9.3, Critical) - Affected Versions:
@strapi/content-type-builder<=5.33.1 (v5),@strapi/plugin-content-type-builder<=4.26.0 (v4) - How to Patch: Immediately update your Strapi to >=5.33.2 (v5) or >=4.26.1 (v4)
Description of CVE-2026-22599
A database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the column.defaultTo attribute when creating or modifying a content type. Setting defaultTo as a tuple [value, { isRaw: true }] caused the value to be passed directly into Knex's db.connection.raw() during schema migration without sanitization, allowing arbitrary statement execution at the database layer. Depending on the database engine, this enabled arbitrary file read via database utility functions, denial of service via forced server crash on schema-migration error, and on engines that permit external program execution, remote code execution against the database server.
The patch addresses this by restricting all Content-Type Builder write APIs to development mode only. Production deployments running v5.33.2 or later return 404 for requests against /content-type-builder/content-types and related endpoints, removing the network-reachable attack surface entirely.
IoC's for CVE-2026-22599
Indicators that an instance running an unpatched version may have been exploited:
- HTTP access logs containing POST or PUT requests to
/content-type-builder/content-typesfrom a non-internal source. Regex pattern:(POST|PUT)\s+/content-type-builder/ - Database server logs containing unexpected DEFAULT clause values that reference filesystem-access or program-execution helper functions of your database engine
- Strapi server crashes immediately following a content-type creation or update, observed as the Node process exiting during the schema-migration step
- Files appearing under unexpected paths on the database host that match content-type DEFAULT values from the application
- Newly-created content-types named or shaped to extract specific data (attribute names like
passwd,etc,env,config)
Impact
Untrusted input alters a database query, allowing the attacker to read or modify data the query was not intended to access. Typical impact: data disclosure or modification.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
@strapi/content-type-builder to 5.33.2 or later; @strapi/plugin-content-type-builder to 4.26.1 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-22599? CVE-2026-22599 is a critical-severity SQL injection vulnerability in @strapi/content-type-builder (npm), affecting versions >= 5.0.0, < 5.33.2. It is fixed in 5.33.2, 4.26.1. Untrusted input alters a database query, allowing the attacker to read or modify data the query was not intended to access.
- Which packages are affected by CVE-2026-22599?
@strapi/content-type-builder(npm) (versions >= 5.0.0, < 5.33.2)@strapi/plugin-content-type-builder(npm) (versions >= 4.0.0, < 4.26.1)
- Is there a fix for CVE-2026-22599? Yes. CVE-2026-22599 is fixed in 5.33.2, 4.26.1. Upgrade to this version or later.
- Is CVE-2026-22599 exploitable, and should I be worried? Whether CVE-2026-22599 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-22599 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-22599?
- Upgrade
@strapi/content-type-builderto 5.33.2 or later - Upgrade
@strapi/plugin-content-type-builderto 4.26.1 or later
- Upgrade