Read the docs
TI-2022-18756 Aliases CVE-2022-39382GHSA-25mx-2mxm-6343

NODE_ENV in Keystone defaults to development with esbuild

Priority HIGH 82CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/[email protected] || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive functionality in their production builds are vulnerable to `NODE_ENV` being inlined to `"development"` for user code, irrespective of what your environment variables. If you do not use `NODE_ENV` in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use `NODE_ENV` to trigger particular behaviors (optimizations, security or otherwise) should still respect your environment's configured `NODE_ENV` variable. The application's dependencies, as found in `node_modules` (including `@keystone-6/core`), are typically not compiled as part of this process, and thus should be unaffected. We have tested this assumption by verifying that `NODE_ENV=production yarn keystone start` still uses secure cookies when using `statelessSessions`. This vulnerability has been fixed in @keystone-6/[email protected], regression tests have been added for this vulnerability in #8063.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0206 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed keystone (keystonejs): 3.0.2@keystone-6/core (npm): 3.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
keystonejskeystone3.0.0 to before 3.0.23.0.2Patch availableCNA
—@keystone-6/core (npm)3.0.0 to before 3.0.23.0.2Patch availableGHSA-25mx-2mxm-6343
  • keystone Vendorkeystonejs Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available CNA
  • @keystone-6/core (npm) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-25mx-2mxm-6343

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:keystonejs:keystone:3.0.0:*:*:*:*:node.js:*:*3.0.0Vulnerablekeystonejs
cpe:2.3:a:keystonejs:keystone:3.0.1:*:*:*:*:node.js:*:*3.0.1Vulnerablekeystonejs
  • cpe:2.3:a:keystonejs:keystone:3.0.0:*:*:*:*:node.js:*:* Versions 3.0.0 Vulnerable ·keystonejs
  • cpe:2.3:a:keystonejs:keystone:3.0.1:*:*:*:*:node.js:*:* Versions 3.0.1 Vulnerable ·keystonejs

Remediation

  • Fix · CNA keystone (keystonejs) Fixed in 3.0.2
  • Fix · GHSA-25mx-2mxm-6343 @keystone-6/core (npm) Fixed in 3.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39382
  2. 2026-10-03 Alias added: GHSA-25mx-2mxm-6343

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2022-18698 @keystone-6/core vulnerable to field-level access-control bypass for multiselect field CVSS 3.1CRITICAL 9.8
  • TI-2017-11626 CSV Injection (aka Excel Macro Injection or Formula Injection) exists in… CVSS 3.0HIGH 8.8
  • TI-2022-11852 An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1… CVSS 3.1CRITICAL 9.8
  • TI-2017-12181 KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF… CVSS 3.0HIGH 8.8
  • TI-2015-07619 Credentials management flaw in HackerOne keystone node module CVSS 3.0HIGH 7.5
  • TI-2017-11625 A cross-site scripting (XSS) vulnerability exists in… CVSS 3.0MEDIUM 6.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences