Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
# Summary The value of `graphql.maxTake` can be bypassed by providing a negative input. This can be used to exceed the developer's intended `graphql.maxTake` value, allowing queries to return results in excess of the `graphql.maxTake` value set. # Impact This affects any project relying on `graphql.maxTake` to bound the number of items returned per query. # Patches This issue has been patched in `@keystone-6/core` version `6.5.3`. If you cannot patch, you can workaround this by restricting `take` input values in your GraphQL queries to the bounded value, or by blocking negative values. # Credit This issue was found by [Haxset's](https://haxset.com) Security Scanner and validated by their team.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-63421US | — | — | ||
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument dire… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/keystonejs/keystonePACKAGE
- https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1WEB
- https://github.com/keystonejs/keystone/pull/9859WEB
- https://github.com/keystonejs/keystone/releases/tag/@keystone-6/core@6.5.3WEB
- https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvhWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan