Keystone is vulnerable to CSV injection

Description

References

• nvd.nist.gov/vuln/detail/CVE-2017-15879 · ADVISORY
• keystonejs/keystone#4478 · WEB
• GitHub Advisory GHSA-6494-v9fq-fgq2 · ADVISORY
• packetstormsecurity.com/files/144755/KeystoneJS-4.0.0-beta.5-Unauthenticated-CSV-Injection.html · WEB
• exploit-db.com/exploits/43053 · WEB
• exploit-db.com/exploits/43053 · Third Party Advisory

keystone 的其他漏洞

• CVE-2026-33326中危 4.3Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany…
• CVE-2025-46720中危 4.3Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `updat…
• CVE-2023-40027中危 5.3Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `ad…
• CVE-2023-34247中危 4.1Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, w…
• CVE-2022-39382严重 9.8Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/[email protected] || 3.0.1` users that use `NODE_ENV` to trigger…