Cross-Site Scripting in keystone
Summary
GHSA-h29r-4vqp-8jxf: Cross-Site Scripting in keystone. Affects keystone versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone is an npm package that provides a content management system (CMS) and web application framework for Node.js. It allows developers to quickly build websites and applications with features such as user authentication, database management, and content editing. However, a vulnerability has been discovered in Keystone that could potentially allow an attacker to execute malicious scripts on a user's browser, leading to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in Keystone arises from improper input sanitization and validation. When user-supplied data is not properly filtered or escaped, it can be rendered as HTML on the web page, allowing an attacker to inject malicious scripts. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the user. The severity of this vulnerability is considered moderate.
How To Fix
Latest published version: 4.2.1 as of 22 Oct 2026
npm install keystone@4.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.0
This is the first release that contains the fix.
npm install keystone@4.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Keystone package is vulnerable to cross-site scripting (XSS) attacks due to improper input sanitization and validation. To mitigate this vulnerability, it is crucial to update to version 4.0.0 or later of the Keystone package. This update includes necessary fixes to prevent the execution of malicious scripts. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
Keystone is an npm package that provides a content management system (CMS) and web application framework for Node.js. It simplifies the development process by offering features such as user authentication, database management, and content editing.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, data theft, and unauthorized actions on behalf of the user.
This vulnerability in Keystone allows an attacker to inject and execute malicious scripts on a user's browser. This can lead to cross-site scripting (XSS) attacks, compromising the security and integrity of the application.
The severity of this vulnerability is considered moderate. While it has the potential to cause significant harm, it requires user interaction or specific conditions to be exploited.
To protect your application from this vulnerability, it is recommended to upgrade to version 4.0.0 or later of the Keystone package. This update includes fixes to properly sanitize and validate user input, preventing the execution of malicious scripts.
References
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
