Skip to content
OpenAdvisories

Product · keystonejs

keystone

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-63421

    Keystone: `graphql.maxTake` bypass with negative `take`

    Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to …

    keystonejs keystone @keystone-6/core npm