Arbitrary Command Injection in strapi/strapi


Reported on

Feb 17th 2022


When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular link (, this happens due to improper sanitization of user input.

Steps to Reproduce the POC

1) npx create-strapi-app my-project --quickstart --template ";touch poc.txt;"
2) Perform "ls" command and you will see that a file called "poc.txt" was created in the current directory.


An attacker can execute arbitrary os commands which can help him perform local privilege escalation to gain root access if strapi package can be run as sudo.

PoC (Proof)

Fix / Solution

Sanitize the input of template parameter before introducing it to the execution context.


R.Srikar ( & Abhishek S(


We are processing your report and will contact the strapi team within 24 hours. a year ago
We have contacted a member of the strapi team and are waiting to hear back a year ago
We have sent a follow up to the strapi team. We will try again in 7 days. a year ago
Alexandre BODIN
a year ago


@admin, This issue is accurate but the severity doesn't really make sense as most of the time the only person that can use this vector is the developer running the command themselves on their computer. We are going to make a fix for the sake of it but it is far from being critical

Jamie Slome
a year ago


@alexandrebodin - thank you for the information here!

You are welcome to adjust the severity of the report using the adjust severity button on the action buttons in the right panel.

Let me know if you have any questions!

Alexandre BODIN modified the report
a year ago
Alexandre BODIN validated this vulnerability 10 months ago
231tr0n has been awarded the disclosure bounty
The fix bounty is now up for grabs
Alexandre BODIN
10 months ago


@admin it's a bit unclear where do we put the fix info. It wasn't fixed but the reporting person so not sure we should use the confirm fix button here. Can you walk me through that please

Jamie Slome
10 months ago


@alexandrebodin - if you click the Confirm fix button, a modal will pop up asking about the branch and commit SHA that the fix exists on/at (it does not confirm a fix immediately). You will also be able to select who the fixer is too. Once you have filled this information in, you can submit the form.

Let me know if you have any more questions!

Alexandre BODIN marked this as fixed in 4.1.0 with commit 2a3f5e 10 months ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation