Keystonejs vulnerabilities
We track 3 vulnerabilities in Keystonejs products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 21, 2026.
Latest Keystonejs vulnerabilities
- 7.5 High severity
Keystone is a content management system for Node.js.
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to p
- 9.8 Critical severity
keystone: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/[email protected] || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"development
- 9.8 Critical severity
keystone: Incorrect Authorization
@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their `multiselect` fields to use the field-level access control - if configured - are vulner