keystone
2026-11-03The superpowered headless CMS for Node.js — built with GraphQL and React
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- MITPermissive · OSI-approved
- Security
- 10 advisories2 critical, 2 high, 3 medium, 3 low · Scorecard 5.3/10
- Supported versions
- No scheduleendoflife.date does not track this project
10k stars · 1.3k forks · 160 open issues · last release 12 days ago · data checked 48 minutes ago
Security advisories
All advisories on GitHubThe 10 most recent advisories published by the maintainers: 2 critical, 2 high, 3 medium, 3 low. Check the patched version against the one you run.
- mediumGHSA-8p2p-6579-wxmqOct 27, 2026Hidden item existence disclosure via `cursor`
- Affected
- >= 5.0.0, <= 8.1.0
- Patched in
- 8.2.0
- highCVE-2026-63421Jul 1, 2026`graphql.maxTake` bypass with negative `take`
- Affected
- <=6.5.2
- Patched in
- 6.5.3
- mediumCVE-2026-33326Mar 19, 2026@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
- Affected
- <= 6.5.1
- Patched in
- >= 6.5.2
- lowCVE-2025-46720May 5, 2025Field-level `isFilterable` bypass for update and delete mutations
- Affected
- <=6.4.0
- Patched in
- >=6.5.0
- mediumCVE-2023-40027Aug 15, 2023When `ui.isAccessAllowed` is undefined, the admin meta GraphQL query is publicly accessible
- Affected
- <5.5.0
- Patched in
- 5.5.1
- lowCVE-2023-34247Jun 13, 2023Open redirect in @keystone-6/auth
- Affected
- <7.0.0,7.0.0
- Patched in
- >=7.0.1
- lowGHSA-5fp6-4xw3-xqq3Jun 11, 2023k-sortable identifiers, `cuid` are the default
- Affected
- *
- criticalCVE-2022-39382Nov 3, 2022NODE_ENV defaults to development with esbuild
- Affected
- 3.0.0,3.0.1
- Patched in
- 3.0.2
- criticalCVE-2022-39322Oct 18, 2022Field-level access-control bypass for multiselect field
- Affected
- 2.2.0 || 2.3.0
- Patched in
- 2.3.1
- highCVE-2022-0087Jan 10, 2022Reflected cross-site scripting (XSS) vulnerability
- Affected
- 1.0.0>=1.0.1
- Patched in
- 1.0.2