Search for packages
| purl | pkg:npm/keystone@4.0.0-beta.4 |
| Next non-vulnerable version | 4.0.0-beta7 |
| Latest non-vulnerable version | 5.5.1 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2yxf-3ebk-nbeu
Aliases: CVE-2017-15879 GHSA-6494-v9fq-fgq2 |
Improper Input Validation CSV Injection via a value that is mishandled in a CSV export. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-ndu1-2s48-pucm
Aliases: CVE-2017-15878 GHSA-7qcx-jmrc-h2rr |
Cross-site Scripting Possible Cross-site scripting via the "Contact Us feature". |
Affected by 2 other vulnerabilities. |
|
VCID-sw46-5p81-kqhv
Aliases: CVE-2017-16570 GHSA-q43c-g2g7-6gxj |
Cross-Site Request Forgery (CSRF) KeystoneJS allows application-wide CSRF bypass by removing the CSRF parameter and value. |
Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-04T20:10:09.039570+00:00 | GitLab Importer | Affected by | VCID-sw46-5p81-kqhv | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/keystone/CVE-2017-16570.yml | 38.6.0 |
| 2026-06-04T20:09:57.535806+00:00 | GitLab Importer | Affected by | VCID-ndu1-2s48-pucm | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/keystone/CVE-2017-15878.yml | 38.6.0 |
| 2026-06-04T20:09:50.524310+00:00 | GitLab Importer | Affected by | VCID-2yxf-3ebk-nbeu | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/keystone/CVE-2017-15879.yml | 38.6.0 |