CVE-2017-15881: Cross-Site Scripting in keystone
Summary
CVE-2017-15881: Cross-Site Scripting in keystone. Affects keystone versions < 4.0.0-beta7. Fixed in 4.0.0-beta7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone is an npm package that provides a content management system (CMS) and web application framework for Node.js. It allows developers to build websites and applications with ease. However, versions of Keystone prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS) attacks. This vulnerability arises from the package's failure to properly encode rendered HTML on admin-created blog posts. Exploiting this vulnerability requires having access to an admin account.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in Keystone allows attackers to execute arbitrary JavaScript code in the victim's browser. By injecting malicious scripts into admin-created blog posts, an attacker can potentially steal sensitive information, perform actions on behalf of the victim, or manipulate the website's content. This vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install keystone@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.0-beta7
This is the first release that contains the fix.
npm install keystone@4.0.0-beta7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, versions of Keystone prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS) attacks. It is crucial to update to version 4.0.0 or later to mitigate this vulnerability. Failure to do so may expose your application to potential security risks. For further support and guidance, please reach out to DevNack.com.
See every vulnerability recorded for keystone →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, perform actions on behalf of the victim, or manipulate the website's content.
If your application uses an older version of Keystone (prior to 4.0.0) and allows admin-created blog posts, it is vulnerable to Cross-Site Scripting (XSS) attacks. An attacker with access to an admin account can inject malicious scripts into blog posts, potentially compromising the security and integrity of your application.
No, there is no known workaround for this vulnerability. It is recommended to update to version 4.0.0 or later of the Keystone package to fix the issue.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
