keystonejs keystone vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20232
3. 20251
4. 20263

Newest CVEs

• CVE-2026-63421

  Keystone: `graphql.maxTake` bypass with negative `take`

  keystonejs · keystone

  High7.5
• CVE-2026-10802

  keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

  keystonejs · keystone

  Medium5.3
• CVE-2026-33326

  @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany

  keystonejs · keystone

  Medium4.3
• CVE-2025-46720

  Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

  keystonejs · keystone

  Low3.1
• CVE-2023-40027

  Conditionally missing authorization in @keystone-6/core

  keystonejs · keystone

  Low3.7
• CVE-2023-34247

  @keystone-6/auth Open Redirect vulnerability

  keystonejs · keystone

  Medium6.1
• CVE-2022-39382

  NODE_ENV in Keystone defaults to development with esbuild

  keystonejs · keystone

  Critical9.8
• CVE-2022-39322

  @keystone-6/core vulnerable to field-level access-control bypass for multiselect field

  keystonejs · keystone

  Critical9.1