CVE-2026-22599: Strapi, authenticated SQL injection

Content-Type Builder accepts an unknown column.defaultTo. The schema builder passes it to Knex as a raw default. The next insert runs that SQL. Needs an administrator JWT and the CTB write API.

Name: CVE-2026-22599: Strapi, authenticated SQL injection
Type: N-day analysis
CVE: CVE-2026-22599
CVE Risk: critical
Disclosure Status: public
Vendor: Strapi
Affected: Strapi through 5.33.1. Patched in 5.33.2 and 4.26.1.
Published: 28 Oct 2026
Updated: 28 Oct 2026
Tags: n-day, strapi, sqli, cwe-89

Strapi, authenticated SQL injection

Strapi 5.33.1 - Strapi

I am @abraxas_null. Loopback lab. CVE-2026-22599-Abraxas-Labs.py chdirs into lab/ and runs run.sh.

Content-Type Builder write API database-query injection. Yup validates but does not strip unknown column.defaultTo. Schema builder merges [value, { isRaw: true }] into Knex defaultTo(raw()). Fixed in 5.33.2 / 4.26.1 by hiding CTB write APIs in production.

CVE-2026-22599 (NVD). CWE-89. Vendor: Strapi. Strapi through 5.33.1. Patched in 5.33.2 and 4.26.1.

What an attacker can do

Authenticated administrator JWT. POST /content-type-builder/content-types with a raw DEFAULT expression. Next insert on that type uses attacker SQL. Lab oracle is GHSA22599-WITNESS on a new labitem row, not a shell.

How this showed up in the lab

I mapped createColumn spreading attribute.column over defaultTo, then isRaw calling knex raw() unsanitized. Stood up Strapi 5.33.1, registered admin, posted the content type, inserted a row.

Fail-controls already in the lab: eval/base64/system is not the witness; a reverse shell is not the witness; 5.33.2 must not honor the raw tuple.

The lab

Port 18098. Strapi 5.33.1. Administrator JWT. CTB write API reachable (pre-patch: also production). ./run.sh.

Target only 127.0.0.1:18098 (or the loopback you bound).

Plain text

python3 CVE-2026-22599-Abraxas-Labs.py

That chdirs into lab/ and runs run.sh (compose up, wait for admin, then poc.py).