Advisory Weakness Curation

Command injection in strapi When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular link https://github.com/strapi/strapi/blob/master/packages/generators/app/lib/utils/fetch-npm-template.js#L13, this happens due to improper sanitization of user input.

Command injection in strapi Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.