CVE-2017-15878: Cross-Site Scripting in keystone
Summary
CVE-2017-15878: Cross-Site Scripting in keystone. Affects keystone versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone is an npm package used for authentication and access control in Node.js applications. It provides a set of APIs and tools for managing user authentication, authorization, and session management. The package is vulnerable to Cross-Site Scripting (XSS) attacks, specifically on the 'Contact Us' page. This vulnerability allows attackers to inject malicious JavaScript code into the message field of the contact form. When an admin opens a new inquiry, the injected code is executed in their browser, potentially leading to unauthorized access or data theft.
Vulnerability Detail
The vulnerability in keystone arises from a failure to properly sanitize user input on the 'Contact Us' page. This allows attackers to submit contact forms with malicious JavaScript code, which is not properly encoded in the output. As a result, when an admin opens a new inquiry, the injected JavaScript code is executed in their browser. This can lead to various consequences, such as session hijacking, data theft, or unauthorized actions on behalf of the admin. The vulnerability has a CVSS score of 6.1 (Moderate).
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install keystone@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.0
This is the first release that contains the fix.
npm install keystone@4.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the keystone package prior to version 4.0.0 is vulnerable to Cross-Site Scripting (XSS) attacks on the 'Contact Us' page. This allows attackers to inject and execute arbitrary JavaScript code in the browser of an admin who opens a new inquiry. To mitigate this vulnerability, it is crucial to update keystone to version 4.0.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code in the browser of an admin who opens a new inquiry on the 'Contact Us' page. This can lead to unauthorized access, data theft, or malicious actions on behalf of the admin.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file. It provides a comprehensive report on the vulnerabilities affecting your application.
No, there is no known workaround for this vulnerability. It is recommended to update keystone to the latest version to fix the issue.
There are no publicly known instances of this vulnerability being exploited. However, it is important to patch the vulnerability as soon as possible to prevent any potential attacks.
This vulnerability was discovered by the GitHub Security Lab and reported on November 15, 2017.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
