Read the docs

keystonejs

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

keystonejs records in CISA KEV

No keystonejs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Keystone 13 records HIGH Keystone-5 1 record LOW

Records

13 records in Keystone · all components

TI-2022-18756 CVE-2022-39382 · GHSA-25mx-2mxm-6343

NODE_ENV in Keystone defaults to development with esbuild

Priority HIGH 82

Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/[email protected] || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0206 Published 2022-11-03 Fixed in 3.0.2 CWE-74
TI-2017-11626 CVE-2017-15879 · GHSA-6494-v9fq-fgq2

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in…

Priority MEDIUM 48

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.07217 Published 2017-10-24 Fixed in 4.0.0-beta7 CWE-20
TI-2015-07619 CVE-2015-9240 · GHSA-39pj-gq8q-9pfj

Credentials management flaw in HackerOne keystone node module

Priority LOW 34

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00859 Published 2018-05-29 Fixed in 0.3.16 CWE-255
TI-2017-11625 CVE-2017-15878 · GHSA-7qcx-jmrc-h2rr

A cross-site scripting (XSS) vulnerability exists in…

Priority LOW 33

A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.03415 Published 2017-10-24 Fixed in 4.0.0 CWE-79
TI-2023-17083 CVE-2023-34247 · GHSA-jqxr-vjvv-899m

@keystone-6/auth Open Redirect vulnerability

Priority LOW 27

Keystone is a content management system for Node.JS.

CVSS 3.1MEDIUM 6.1 Adjacent network Low privileges User interaction EPSS 0.00407 Published 2023-06-13 Fixed in 7.0.0 CWE-601
TI-2017-11628 CVE-2017-15881 · GHSA-7cv6-gvx3-m54m

Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote…

Priority LOW 24

Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vuln…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01215 Published 2017-10-24 Fixed in 4.0.0-beta7 CWE-79
Open these records in search →