Keystone (Keystonejs) - vulnerabilities (CVEs)
14 CVEs, 0 in the last 30 days, 242 known versions, newest CVE from 2026-08-21. Vendor: Keystonejs.
CVEs of Keystone
- CVE-2026-63421 - CVSS 7.5 (high), 2026-08-21: Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the…
- CVE-2026-10802 - CVSS 5.3 (medium), 2026-06-04: A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library…
- CVE-2026-33326 - CVSS 4.3 (medium), 2026-03-24: Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by…
- CVE-2025-46720 - CVSS 4.3 (medium), 2025-05-05: Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete`…
- CVE-2023-40027 - CVSS 5.3 (medium), 2023-08-15: Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL…
- CVE-2023-34247 - CVSS 6.1 (medium), 2023-06-13: Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect…
- CVE-2022-39382 - CVSS 9.8 (critical), 2022-11-03: Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `NODE_ENV` to trigger…
- CVE-2022-39322 - CVSS 9.8 (critical), 2022-10-25: @keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who…
- CVE-2022-29354 - CVSS 9.8 (critical), 2022-05-16: An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file.
- CVE-2022-0087 - CVSS 7.1 (high), 2022-01-12: keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2015-9240 - CVSS 7.5 (high), 2018-05-29: Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct…
- CVE-2017-16570 - CVSS 8.8 (high), 2017-11-06: KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In…
- CVE-2017-15881 - CVSS 4.8 (medium), 2017-10-24: Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the…
- CVE-2017-15878 - CVSS 6.1 (medium), 2017-10-24: A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.
- CVE-2017-15879 - CVSS 8.8 (high), 2017-10-24: CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before…
