A stored cross-site scripting vulnerability in the Strapi content manager allows authenticated authors to execute malicious scripts in the sessions of administrators, leading to full account takeover.

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) residing in the WYSIWYG preview component of the content manager. The component fails to sufficiently sanitize input, allowing an authenticated user with Author privileges to inject malicious scripts that execute within the browser session of an Editor or Super Admin when they view the content.

Successful exploitation permits an attacker to perform unauthorized actions on behalf of a privileged user, such as an administrator. Given the CVSS score of 8.7, this is a high severity issue that can lead to complete system compromise, unauthorized data access, and loss of integrity within the content management environment.

Immediate Action: Upgrade to Strapi version 5.48.1 or later to implement the necessary sanitization logic within the WYSIWYG preview component.

Proactive Monitoring: Audit content logs and entries created by users with Author roles to identify suspicious script tags or anomalous content structures.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources within the administrative dashboard.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to administrative integrity within the Strapi platform. Organizations should prioritize patching to version 5.48.1 immediately, as the flaw allows an authenticated attacker to elevate privileges through session hijacking. Until the update is applied, limit the number of users assigned the Author role and monitor administrative activity for signs of unauthorized session access.