Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@keystone-6/core

7 known vulnerabilities (2 critical, 1 high, 2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 critical, 1 high, 2 medium, 2 low
Weekly downloads
18.4K
Dependents
1
Registry
npm

Advisories 7

  • Keystone: `graphql.maxTake` bypass with negative `take`

    Affected: fixed in 6.5.3.

  • CVE-2026-10802Medium 5.3

    keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

    Affected: through 6.5.3.

  • CVE-2026-33326Medium 4.3

    @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany

    Affected: fixed in 6.5.2.

  • Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

    Affected: fixed in 6.5.0.

  • Conditionally missing authorization in @keystone-6/core

    Affected: fixed in 5.5.1.

  • CVE-2022-39382Critical 9.8

    NODE_ENV in Keystone defaults to development with esbuild

    Affected: from 3.0.0, fixed in 3.0.2.

  • CVE-2022-39322Critical 9.1

    @keystone-6/core vulnerable to field-level access-control bypass for multiselect field

    Affected: from 2.2.0, fixed in 2.3.1.