npm/@keystone-6/core

@keystone-6/core's NODE_ENV defaults to development with esbuild

Modified: 11/8/2023

Keystone: GraphQL API Endpoint Lacks Query Depth Limits

Modified: 7/14/2026

@keystone-6/core's bundled cuid package known to be insecure

Modified: 6/23/2023

Field-level access-control bypass for multiselect field

Modified: 11/8/2023

When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible

Modified: 11/8/2023

@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)

Modified: 3/27/2026

Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

Modified: 8/21/2026

Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

Modified: 5/5/2025