VulnerableCode Package Details - pkg:npm/%40strapi/utils@4.0.2

Search for packages

Vulnerability	Summary	Fixed by
VCID-5bpn-j31w-k7gb Aliases: CVE-2023-34093 GHSA-chmr-rg2f-9jmf	Exposure of Sensitive Information to an Unauthorized Actor Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `privateAttributes` getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes). Anyone can be impacted, depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected. Version 4.10.8 contains a patch for this issue.	4.10.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-adab-ztym-ayhd Aliases: CVE-2023-36472 GHSA-v8gg-4mq2-88q4	Strapi may leak sensitive user information, user reset password, tokens via content-manager views Attackers can get access to user reset password tokens if they have the configure view permissions.	4.11.7 Affected by 0 other vulnerabilities.
VCID-mffu-ck9j-vkg8 Aliases: CVE-2023-34235 GHSA-9xg4-3qfm-9w8f	Exposure of Sensitive Information to an Unauthorized Actor Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to another table they want to query, the query changes from `password` to `t1.password`. `password` is protected by filtering protections but `t1.password` is not protected. This can lead to filtering attacks on everything related to the object again, including admin passwords and reset-tokens. Version 4.10.8 fixes this issue.	4.10.8-exp.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.10.8 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-5bpn-j31w-k7gb
Aliases:
CVE-2023-34093
GHSA-chmr-rg2f-9jmf

Exposure of Sensitive Information to an Unauthorized Actor Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `privateAttributes` getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes). Anyone can be impacted, depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected. Version 4.10.8 contains a patch for this issue.

4.10.8
Affected by 1 other vulnerability.

VCID-adab-ztym-ayhd
Aliases:
CVE-2023-36472
GHSA-v8gg-4mq2-88q4

Strapi may leak sensitive user information, user reset password, tokens via content-manager views Attackers can get access to user reset password tokens if they have the configure view permissions.

4.11.7
Affected by 0 other vulnerabilities.

VCID-mffu-ck9j-vkg8
Aliases:
CVE-2023-34235
GHSA-9xg4-3qfm-9w8f

Exposure of Sensitive Information to an Unauthorized Actor Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to another table they want to query, the query changes from `password` to `t1.password`. `password` is protected by filtering protections but `t1.password` is not protected. This can lead to filtering attacks on everything related to the object again, including admin passwords and reset-tokens. Version 4.10.8 fixes this issue.

4.10.8-exp.0
Affected by 2 other vulnerabilities.

4.10.8
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T04:07:10.220704+00:00	GitLab Importer	Affected by	VCID-adab-ztym-ayhd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@strapi/utils/CVE-2023-36472.yml	38.6.0
2026-06-06T03:58:45.270138+00:00	GitLab Importer	Affected by	VCID-mffu-ck9j-vkg8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@strapi/utils/CVE-2023-34235.yml	38.6.0
2026-06-06T03:58:41.322187+00:00	GitLab Importer	Affected by	VCID-5bpn-j31w-k7gb	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@strapi/utils/CVE-2023-34093.yml	38.6.0