@kids-reporter/cms-core (>=1.0.17, <=1.0.36), @kids-reporter/draft-editor (>=1.0.19, <=1.0.36) potentially affected by CVE-2026-63421 via @keystone-6/core (6.5.1)

@keystone-6/core NPM version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @kids-reporter/cms-core =1.0.17, =1.0.19, =1.0.36 Source cves: CVE-2026-63421 Source advisory: SNYK:JS-KEYSTONE6CORE-20158545...

Use of Incorrect Operator

Overview Affected versions of this package are vulnerable to Use of Incorrect Operator via the take parameter in GraphQL queries. An attacker can cause excessive resource consumption by supplying negative values to bypass intended query limits. Workaround This vulnerability can be mitigated by...

@kids-reporter/cms-core (>=1.0.17, <=1.0.36), @kids-reporter/draft-editor (>=1.0.19, <=1.0.36) potentially affected by CVE-2026-63421 via @keystone-6/core (6.5.1)

@keystone-6/core NPM version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @kids-reporter/cms-core =1.0.17, =1.0.19, =1.0.36 Source cves: CVE-2026-63421 Source advisory: OSV:GHSA-CQMQ-8755-7XVH...

PT-2026-80269

Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set. Impact This affects any project relying on graphql.maxTake ...

@beemstream/keystone-document-gallery (>=2.0.0, <=2.0.6), @k6js/admin-ui (>=0.3.0-20250618-02, <=0.4.7) +19 more potentially affected by CVE-2026-10802 via @keystone-6/core (>=1.1.1, <=8.1.0)

@keystone-6/core NPM version =1.1.1, =2.0.0, =0.3.0-20250618-02, =1.0.17, =1.0.19, =0.0.1, =2.1.0-beta.0, =2.1.0-beta.0, =0.0.1-alpha.1, =1.0.0, =6.0.21, =1.0.0, =1.0.3, =1.0.12 and more Source cves: CVE-2026-10802 Source advisory: SNYK:JS-KEYSTONE6CORE-17179719...

@k6js/admin-ui (>=0.3.0-20250618-02, <=0.4.7), @kids-reporter/cms-core (>=1.0.17, <=1.0.36) +5 more potentially affected by CVE-2026-10802 via @keystone-6/core (>=6.5.1, <=6.5.3)

@keystone-6/core NPM version =6.5.1, =0.3.0-20250618-02, =1.0.17, =1.0.19, =0.0.1, =1.0.0, =5.0.1 - keystone-plugin-all-in-one-accessibility 1.0.1 Source cves: CVE-2026-10802 Source advisory: OSV:GHSA-45JQ-C8XM-JFW9...

@kids-reporter/cms-core (>=1.0.17, <=1.0.36), @kids-reporter/draft-editor (>=1.0.19, <=1.0.36) potentially affected by CVE-2026-33326 via @keystone-6/core (6.5.1)

@keystone-6/core NPM version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @kids-reporter/cms-core =1.0.17, =1.0.19, =1.0.36 Source cves: CVE-2026-33326 Source advisory: OSV:GHSA-CGCG-Q9JH-5PR2...

@kids-reporter/cms-core (>=1.0.17, <=1.0.36), @kids-reporter/draft-editor (>=1.0.19, <=1.0.36) potentially affected by CVE-2025-46720 +1 more via @keystone-6/core (6.5.1)

@keystone-6/core NPM version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @kids-reporter/cms-core =1.0.17, =1.0.19, =1.0.36 Source cves: CVE-2025-46720, CVE-2026-33326 Source advisory:...

EUVD-2022-7038

Malicious code in bioql PyPI...

@beemstream/keystone-document-gallery (>=2.0.0, <=2.0.6), @murz/keystone-field-nested-set (4.0.1-1) +11 more potentially affected by CVE-2025-46720 via @keystone-6/core (>=1.1.1, <=5.8.0)

@keystone-6/core NPM version =1.1.1, =2.0.0, =2.1.0-beta.0, =2.1.0-beta.0, =0.0.1-alpha.1, =1.0.0, =6.0.21, =0.0.1, =1.0.0, =1.0.0-beta.4, =0.0.1, =0.1.0, =0.2.0 Source cves: CVE-2025-46720 Source advisory: MEND:CVE-2025-46720...

CVE-2025-46720: Observable Discrepancy

Keystone is a content management system for Node.js. Prior to version 6.5.0, field.isFilterable access control can be bypassed in update and delete mutations by adding additional unique filters. These filters can be used as an oracle to probe the existence or value of otherwise unreadable fields...

CVE-2022-39382

Keystone is a headless CMS for Node.js — built with GraphQL and React.@keystone-6/[email protected] || 3.0.1 users that use NODEENV to trigger security-sensitive functionality in their production builds are vulnerable to NODEENV being inlined to "development" for user code, irrespective of what your...

CVE-2022-39322

@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who expected their multiselect fields to use the field-level access control - if configured - are vulnerable to their field-level access contro...

Improper Access Control

@keystone-6/core is vulnerable to Improper Access Control. The vulnerability exists when the ui.isAccessAllowed parameter in the KeystoneMeta function of adminMetaSchema.ts is set as undefined, which allows an attacker to access the admin meta GraphQL query if the session strategy is not defined...

GHSA-9CVC-V7WM-992C When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible

Summary When ui.isAccessAllowed is undefined, the adminMeta GraphQL query is publicly accessible, that is to say, no session is required for the query. This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible if a session strategy is...

@story-telling-reporter/draft-editor (>=2.1.0-beta.0, <=2.1.2) potentially affected by CVE-2023-40027 via @keystone-6/core (5.2.0)

@keystone-6/core NPM version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @story-telling-reporter/draft-editor =2.1.0-beta.0, =2.1.2 Source cves: CVE-2023-40027 Source advisory: OSV:GHSA-9CVC-V7WM-992C...

CVE-2023-40027 Conditionally missing authorization in @keystone-6/core

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

CVE-2023-40027 Conditionally missing authorization in @keystone-6/core

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

CVE-2023-40027: Missing Authorization

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

Open Redirect

@keystone-6/auth is vulnerable to Open Redirect. The vulnerability exists due to improper path sanitization which can result in users being redirected to domains other than the relative host by bypassing the / filter...