| Package | Affected versions | Patched versions |
|---|---|---|
| keystone | < 1.0.2 | 1.0.2 |
| @keystone-6/auth | < 1.0.2 | 1.0.2 |
| @keystone-next/auth | ≤ 37.0.0 |
This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package.
The vulnerability can impact users of the administration user interface when following an untrusted link to the signin or init page.
This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability.
Please upgrade to @keystone-6/auth >= 1.0.2, where this vulnerability has been closed.
If you are using @keystone-next/auth, we strongly recommend you upgrade to @keystone-6.
If for some reason you cannot upgrade the dependencies in software, you could alternatively
https://owasp.org/www-community/attacks/xss/
Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free