GHSA-5fp6-4xw3-xqq3
@keystone-6/core's bundled cuid package known to be insecure
GHSA-5fp6-4xw3-xqq3 is a vulnerability with no CVSS score yet in @keystone-6/core, published June 12, 2023. No source lists public exploit code. No source names a fixed version.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Summary
The cuid package used by @keystone-6/* and upstream dependencies is deprecated and marked as insecure by the author.
As reported by the author
Cuid and other k-sortable and non-cryptographic ids (Ulid, ObjectId, KSUID, all UUIDs) are all insecure. Use @paralleldrive/cuid2 instead.
What are doing about this?
- We are waiting on Prisma to add support for
cuid2 - Alternatively, we might default to a random string ourselves
What can I do about this?
We have added a work-around for users who want to provide custom identifiers in https://github.com/keystonejs/keystone/pull/8645
What if I need a cuid?
The features marked as a security vulnerability by @paralleldrive are sometimes actually needed (as written in the README of cuid) - the problem is the inherent risks that features like this can have.
You might actually want the features of a monotonically increasing (auto-increment, k-sortable), and timestamp-based id as part of your application, and keystone should support that - but you might not want them by default. This is why this security advisory has been accepted by me (@dcousens), we currently use cuid identifiers by default, and that should change.
Impact
I have accepted this security advisory on the basis that we don't need this kind of identifier typically, and the need for them should be driven by an application's requirements, not a convenient default.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@keystone-6/corenpm | through 5.3.1 | None known |
What each source reports
GitHub AdvisoriesNo score
@keystone-6/core's bundled cuid package known to be insecure
Summary
The cuid package used by @keystone-6/* and upstream dependencies is deprecated and marked as insecure by the author.
As reported by the author
Cuid and other k-sortable and non-cryptographic ids (Ulid, ObjectId, KSUID, all UUIDs) are all insecure. Use @paralleldrive/cuid2 instead.
What are doing about this?
- We are waiting on Prisma to add support for
cuid2 - Alternatively, we might default to a random string ourselves
What can I do about this?
We have added a work-around for users who want to provide custom identifiers in https://github.com/keystonejs/keystone/pull/8645
What if I need a cuid?
The features marked as a security vulnerability by @paralleldrive are sometimes actually needed (as written in the README of cuid) - the problem is the inherent risks that features like this can have.
You might actually want the features of a monotonically increasing (auto-increment, k-sortable), and timestamp-based id as part of your application, and keystone should support that - but you might not want them by default. This is why this security advisory has been accepted by me (@dcousens), we currently use cuid identifiers by default, and that should change.
Impact
I have accepted this security advisory on the basis that we don't need this kind of identifier typically, and the need for them should be driven by an application's requirements, not a convenient default.
- Record
GHSA-5fp6-4xw3-xqq3- Updated
- 2026-11-02
OSVNo score
@keystone-6/core's bundled cuid package known to be insecure
Summary
The cuid package used by @keystone-6/* and upstream dependencies is deprecated and marked as insecure by the author.
As reported by the author
Cuid and other k-sortable and non-cryptographic ids (Ulid, ObjectId, KSUID, all UUIDs) are all insecure. Use @paralleldrive/cuid2 instead.
What are doing about this?
- We are waiting on Prisma to add support for
cuid2 - Alternatively, we might default to a random string ourselves
What can I do about this?
We have added a work-around for users who want to provide custom identifiers in https://github.com/keystonejs/keystone/pull/8645
What if I need a cuid?
The features marked as a security vulnerability by @paralleldrive are sometimes actually needed (as written in the README of cuid) - the problem is the inherent risks that features like this can have.
You might actually want the features of a monotonically increasing (auto-increment, k-sortable), and timestamp-based id as part of your application, and keystone should support that - but you might not want them by default. This is why this security advisory has been accepted by me (@dcousens), we currently use cuid identifiers by default, and that should change.
Impact
I have accepted this security advisory on the basis that we don't need this kind of identifier typically, and the need for them should be driven by an application's requirements, not a convenient default.
- Record
GHSA-5fp6-4xw3-xqq3- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.