keystonejs vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20223
3. 20232
4. 20251
5. 20263

Newest CVEs

• CVE-2026-63421

  Keystone: `graphql.maxTake` bypass with negative `take`

  keystonejs · keystone

  High7.5
• CVE-2026-10802

  keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

  keystonejs · keystone

  Medium5.3
• CVE-2026-33326

  @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany

  keystonejs · keystone

  Medium4.3
• CVE-2025-46720

  Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

  keystonejs · keystone

  Low3.1
• CVE-2023-40027

  Conditionally missing authorization in @keystone-6/core

  keystonejs · keystone

  Low3.7
• CVE-2023-34247

  @keystone-6/auth Open Redirect vulnerability

  keystonejs · keystone

  Medium6.1
• CVE-2022-39382

  NODE_ENV in Keystone defaults to development with esbuild

  keystonejs · keystone

  Critical9.8
• CVE-2022-39322

  @keystone-6/core vulnerable to field-level access-control bypass for multiselect field

  keystonejs · keystone

  Critical9.1
• CVE-2022-0087

  Cross-site Scripting (XSS) - Reflected in keystonejs/keystone

  keystonejs · keystonejs/keystone

  High7.1
• CVE-2021-32624

  Private Field data leak

  keystonejs · keystone-5

  High7.5