Meet Corgea at Black Hat, BSides Las Vegas & DEF CON
Start for Free
npm

@keystone-6/core

View on npm registry
7 Total advisories
7 Vulnerabilities
0 Malware

Vulnerabilities

MEDIUM 4.3
npm

CVE-2026-10802

Keystone: GraphQL API Endpoint Lacks Query Depth Limits
MEDIUM 4.3
npm

CVE-2026-33326

@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
LOW 3.1
npm

CVE-2025-46720

Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields
MEDIUM 5.3
npm

CVE-2023-40027

When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible
CRITICAL 9.8
npm

CVE-2022-39382

@keystone-6/core's NODE_ENV defaults to development with esbuild
CRITICAL 9.1
npm

CVE-2022-39322

Field-level access-control bypass for multiselect field
UNKNOWN
npm

GHSA-5fp6-4xw3-xqq3

@keystone-6/core's bundled cuid package known to be insecure

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes