Keystone is a headless CMS for Node.js — built with GraphQL and React.@keystone-6/core@3.0.0 || 3.0.1 users that use NODE_ENV to trigger security-sensitive functionality in their production builds are vulnerable to NODE_ENV being inlined to development for user code, irrespective of what your environment variables. If you do not use NODE_ENV in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use NODE_ENV to trigger particular behaviors (optimizations, security or otherwise) should still respect your environments configured NODE_ENV variable. The applications dependencies, as found in node_modules (including @keystone-6/core), are typically not compiled as part of this process, and thus should be unaffected. We have tested this assumption by verifying that NODE_ENV=production yarn keystone start still uses secure cookies when using statelessSessions. This vulnerability has been fixed in @keystone-6/core@3.0.2, regression tests have been added for this vulnerability in #8063.
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Keystone | Keystonejs | 3.0.0 (including) | 3.0.0 (including) |
| Keystone | Keystonejs | 3.0.1 (including) | 3.0.1 (including) |