What’s Vulnerable › Vulnerabilities

CVE-2022-0087: Cross-site Scripting (XSS) - Reflected in keystonejs/keystone

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-01-12 · updated 2026-06-17
• Weakness: CWE-79

Description

keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

• keystonejs keystone: before 1.0.2 — fixed in 1.0.2

How to fix

Upgrade to a fixed version: keystonejs keystone 1.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38
• https://huntr.dev/bounties/c9d7374f-2cb9-4bac-9c90-a965942f413e
• https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38
• https://huntr.dev/bounties/c9d7374f-2cb9-4bac-9c90-a965942f413e

Get alerted when CVE-2022-0087 or the next vulnerability affects your stack