Skip to content
OpenAdvisories

Vendor

keystonejs

10 known vulnerabilities.

Products

keystone 8 keystone-5 1 keystonejs/keystone 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-63421

    Keystone: `graphql.maxTake` bypass with negative `take`

    Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to …

    keystonejs keystone @keystone-6/core npm
  • High 7.1
    CVE-2022-0087

    Cross-site Scripting (XSS) - Reflected in keystonejs/keystone

    keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    keystonejs keystonejs/keystone @keystone-6/auth @keystone-next/auth npm
  • High 7.5
    CVE-2021-32624

    Private Field data leak

    Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access…

    keystonejs keystone-5 @keystonejs/keystone npm