Reflected cross-site scripting (XSS) vulnerability
This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package.
Impact
The vulnerability can impact users of the administration user interface when following an untrusted link to the signin or init page.
This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability.
Vulnerability mitigation
Please upgrade to @keystone-6/auth >= 1.0.2, where this vulnerability has been closed.
If you are using @keystone-next/auth, we strongly recommend you upgrade to @keystone-6.
Workarounds
If for some reason you cannot upgrade the dependencies in software, you could alternatively
- disable the administration user interface, or
- if using a reverse-proxy, strip query parameters when accessing the administration interface
References
https://owasp.org/www-community/attacks/xss/
Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | @keystone-6/auth | < 1.0.2 | 1.0.2 |
| Paquete de npm | @keystone-next/auth | <= 37.0.0 | sin corrección |
Referencias
- https://github.com/keystonejs/keystone/security/advisories/GHSA-hrgx-7j6v-xj82
- https://nvd.nist.gov/vuln/detail/CVE-2022-0087
- https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38
- https://github.com/keystonejs/keystone
- https://huntr.dev/bounties/c9d7374f-2cb9-4bac-9c90-a965942f413e
- Vector CVSS
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L- Debilidad (CWE)
CWE-79- Plataforma
- npm
- Paquete
@keystone-6/auth, @keystone-next/auth- Publicada
- 12.01.2022
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-hrgx-7j6v-xj82 - CC BY 4.0
Historial de vulnerabilidades: @keystone-next/auth
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.