HomeContent Toolkit Logo

Content Toolkit

Home

>

Tools

>

Strapi

>

Releases

>

4.5.6

Strapi Release: 4.5.6

Tag Name: v4.5.6

Release Date: 1/11/2023

View Release
Strapi LogoStrapi

Open-source headless CMS built with Node.js. Provides developers with complete freedom in choosing their favorite tools and frameworks for frontend development.

Open SourceHeadlessDeveloper-Friendly

TL;DR

Strapi v4.5.6 is a critical security update that addresses a vulnerability that can be exploited if a malicious actor has access to your admin panel. The release also includes bug fixes for translations, UI improvements, and dependency updates. All users are strongly advised to update as soon as possible.

Highlight of the Release

    • Critical security vulnerability patched (details to be disclosed in the coming weeks)
    • Fixed email templating in Users & Permissions plugin to prevent potential security issues
    • Added prompts to Content Type Builder modals to prevent accidental data loss
    • Fixed various translation issues in the admin interface
    • Improved single-type publishing and draft updating functionality

Migration Guide

No specific migration steps are required for this update. Simply update your Strapi version to v4.5.6:

npm install [email protected]

or

yarn upgrade [email protected]

For those unable to update immediately, Strapi will provide instructions on how to manually construct a patch using Patch Package during their detailed security disclosure in the coming weeks.

Upgrade Recommendations

STRONGLY RECOMMENDED: All users should update to Strapi v4.5.6 as soon as possible due to the critical security vulnerability that was patched in this release.

The security vulnerability can be exploited if a malicious actor has access to your admin panel. Strapi will release detailed information about the vulnerability in approximately two weeks, after giving users adequate time to update.

Enterprise customers who need additional information should open a support ticket.

Bug Fixes

  • Fixed translations in various parts of the admin interface:
    • CarouselAssetActions
    • EditFolderDialog
    • RelationInputDataManager
    • Various Chinese (zh) translations
  • Fixed guided tour documentation link
  • Fixed Content Manager modal closing behavior with escape key or clicking outside
  • Fixed publishing of single-types when configuration is set to true
  • Fixed ability to update draft types
  • Fixed runMigrations functionality (issue #15308)
  • Fixed RouterConfig type in TypeScript definitions
  • Removed generic typing from GenericService for better TypeScript support

New Features

  • Added Hungarian admin translations
  • Added prompts to Content Type Builder modals to prevent premature closing and data loss
  • Enhanced email templating system with stricter validation and interpolation helpers

Security Updates

  • Patched a critical security vulnerability that could be exploited if a malicious actor has access to the admin panel (detailed disclosure planned in the coming weeks)
  • Fixed CVE-2022-23539, CVE-2022-23541, CVE-2022-23540, and CVE-2022-23529 related to JWT vulnerabilities
  • Updated Users & Permissions plugin email templating to prevent potential security issues
  • Updated several dependencies with security fixes:
    • apollo-server-core from 3.1.2 to 3.11.1
    • json5 from 1.0.1 to 1.0.2 and from 2.2.1 to 2.2.2
    • codemirror from 5.65.8 to 5.65.11

Performance Improvements

  • Added --cache option to lint and prettier scripts for faster execution
  • Implemented cache for lint-staged scripts
  • Prevented license ping for API tests to improve test performance

Impact Summary

This release addresses a critical security vulnerability that affects all Strapi instances where a malicious actor could potentially gain unauthorized access if they already have admin panel access. The exact details of the vulnerability will be disclosed in the coming weeks, but immediate updating is strongly recommended.

Beyond the security fix, this release improves the user experience with better modal handling in the Content Type Builder to prevent accidental data loss, fixes various translation issues throughout the admin interface, and enhances the email templating system in the Users & Permissions plugin.

For developers, the release includes TypeScript definition improvements, tooling enhancements with cache options for faster development workflows, and several dependency updates to address security vulnerabilities.

The release also fixes an issue with publishing single-types and updating draft types, which improves content management workflows.

Full Release Notes

⚠️ Security Warning and Notice ⚠️

Strapi was made aware of a critical security vulnerability that was patched in this release, for now we are going to delay the detailed disclosure of the exact details on how to exploit it and how it was patched as we are working with a security researcher to construct a detailed analysis and update the CVE assigned to this issue.

For now the delay timeline looks like we will release the detailed information in the next two (2) weeks and we STRONGLY advise all users update to Strapi v4.5.6 as quickly as possible. Please note that this security vulnerability can only be exploited if the malicious actor currently has access to your admin panel. Once we are confident that we have given adequate time for users to update to this release and we have our disclosure information ready for publication we will make it available.

If you are a Strapi Enterprise customer and would like to request additional information, please open a ticket with our support team and we will work with you to provide information as we are able to.

For those who are unable to update to this release, during our disclosure we will also provide instructions on how you can manually construct a patch and apply it using Patch Package and it's likely that we will construct some of these patches ourselves and make them available to you during our disclosure.

Finally we wanted to give a massive shout out to the security researcher who reported this vulnerability to us in the format that he did, the detail and information he provided was simply fantastic, once he has finished his own detailed log of the vulnerability we will provide a link so you can view the information from his side.

🔥 Bug fix

  • [core:admin] fix: translations of CarouselAssetActions (#15261) @ivan-ha
  • [core:admin] [fix] Guided tour documentation link (#15284) @ronronscelestes
  • [core:content-manager] fix(content-manager): close ListSettingsView/EditFieldForm with escape (#15196) @jhoward1994
  • [core:strapi] Fix: Publishing single-type if config is true, and allow updating the drafts - api (#14767) @iifawzi
  • [core:strapi] Fix runMigrations (#15308) (#15374) @denisukvadim
  • [core:upload] fix: broken translations in EditFolderDialog and various zh translations in Media Library (#15278) @ivan-ha
  • [core:upload] fix: zh translations of content-manager.containers.Edit.information.by (#15289) @ivan-ha
  • [typescript] Remove generic typing form GenericeService (#14208) @Bassel17

📖 Documentation

⚙️ Chore

💅 Enhancement

🚨 Security

📚 Update and Migration Guides

  • General update guide can be found here
  • Migration guides can be found here 📚

Statistics:

File Changed79
Line Additions1,302
Line Deletions1,686
Line Changes2,988
Total Commits116

User Affected:

  • Critical security vulnerability patched that affects admin panel access
  • Improved UI experience with modal closing behaviors and prompts to prevent data loss
  • Fixed translations in various parts of the admin interface

Contributors:

Bassel17paulaxisabeldependabot[bot]drubettilkhoMarc-RoigderrickmehaffyGregorSondermeierinnerdvationsivan-hajhoward1994iifawzironronscelesteschristiancp100pataiadamConvlydenisukvadimpetersg83joshuaellis