Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
# Summary The value of `graphql.maxTake` can be bypassed by providing a negative input. This can be used to exceed the developer's intended `graphql.maxTake` value, allowing queries to return results in excess of the `graphql.maxTake` value set. # Impact This affects any project relying on `graphql.maxTake` to bound the number of items returned per query. # Patches This issue has been patched in `@keystone-6/core` version `6.5.3`. If you cannot patch, you can workaround this by restricting `take` input values in your GraphQL queries to the bounded value, or by blocking negative values. # Credit This issue was found by [Haxset's](https://haxset.com) Security Scanner and validated by their team.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-63421US | — | — | ||
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument dire… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/keystonejs/keystonePACKAGE
- https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1WEB
- https://github.com/keystonejs/keystone/pull/9859WEB
- https://github.com/keystonejs/keystone/releases/tag/@keystone-6/core@6.5.3WEB
- https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvhWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan