Keystonejs vulnerabilities

Products

• Keystone 15

Newest

• keystonejs keystone Keystone: `graphql.maxTake` bypass with negative `take` CVE-2026-63421 Fix available 7.5 HighAugust 21, 2026
• keystonejs keystone keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption CVE-2026-10802 5.3 MediumJune 4, 2026
• keystonejs keystone @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany CVE-2026-33326 Fix available 4.3 MediumMarch 19, 2026
• keystonejs keystone Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields CVE-2025-46720 Fix available 3.1 LowMay 5, 2025
• keystonejs keystone Conditionally missing authorization in @keystone-6/core CVE-2023-40027 Fix available 3.7 LowAugust 15, 2023
• keystonejs keystone @keystone-6/auth Open Redirect vulnerability CVE-2023-34247 Fix available 6.1 MediumJune 13, 2023
• keystonejs keystone NODE_ENV in Keystone defaults to development with esbuild CVE-2022-39382 Fix available 9.8 CriticalNovember 3, 2022
• keystonejs keystone @keystone-6/core vulnerable to field-level access-control bypass for multiselect field CVE-2022-39322 Fix available 9.1 CriticalOctober 18, 2022
• keystonejs keystone An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows... CVE-2022-29354 9.8 CriticalMay 16, 2022
• keystonejs keystone, keystonejs/keystone +1 more Cross-site Scripting (XSS) - Reflected in keystonejs/keystone CVE-2022-0087 Fix available 7.1 HighJanuary 11, 2022
• keystonejs keystone-5 Private Field data leak CVE-2021-32624 7.5 HighMay 24, 2021
• hackerone keystone node module, keystonejs keystone +1 more Authentication Weakness in keystone CVE-2015-9240 Fix available 7.5 HighMay 29, 2018
• keystonejs keystone Cross-Site Request Forgery (CSRF) in keystone CVE-2017-16570 Public exploitFix available 8.8 HighNovember 6, 2017
• keystonejs keystone Cross-Site Scripting in keystone CVE-2017-15881 Fix available 4.8 MediumOctober 24, 2017
• keystonejs keystone Keystone is vulnerable to CSV injection CVE-2017-15879 Public exploitFix available 8.8 HighOctober 24, 2017
• keystonejs keystone Cross-Site Scripting in keystone CVE-2017-15878 Public exploitFix available 6.1 MediumOctober 24, 2017