What’s Vulnerable › Products

keystonejs keystone vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your keystonejs keystone version is affected

Latest keystonejs keystone vulnerabilities

• CVE-2026-63421 — Keystone: `graphql.maxTake` bypass with negative `take` (CVSS 7.5)
• CVE-2026-10802 — keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption (CVSS 4.3)
• CVE-2026-33326 — @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVSS 4.3)
• CVE-2025-46720 — Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields (CVSS 4.3)
• CVE-2023-40027 — Conditionally missing authorization in @keystone-6/core (CVSS 5.3)
• CVE-2023-34247 — @keystone-6/auth Open Redirect vulnerability (CVSS 4.1)
• CVE-2022-39382 — NODE_ENV in Keystone defaults to development with esbuild (CVSS 9.8)
• CVE-2022-39322 — @keystone-6/core vulnerable to field-level access-control bypass for multiselect field (CVSS 9.8)
• CVE-2022-29354 — (CVSS 9.8)
• CVE-2022-0087 — Cross-site Scripting (XSS) - Reflected in keystonejs/keystone (CVSS 6.1)
• CVE-2015-9240 — (CVSS 7.5)
• CVE-2017-16570 — (CVSS 8.8)
• CVE-2017-15881 — (CVSS 4.8)
• CVE-2017-15879 — (CVSS 8.8)
• CVE-2017-15878 — (CVSS 6.1)