CVE-2026-10802 json
keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
published 2026-06-04 5 mo ago modified 2026-07-22 3 mo ago also GHSA-45jq-c8xm-jfw9 , EUVD-2026-34244
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
Patch / fix
- github.com/keystonejs/keystone#9831 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gist.github.com https://gist.github.com/nedlir/0431275665076772844ebfe5167e54f6 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R |
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @keystone-6/core | <=6.5.3 |
no fix listed |
Affected products
- keystonejs keystone
Classification
References
-
github.com
/keystonejs/keystone/pull/9831
issue-tracking, patch, web
-
gist.github.com
/nedlir/0431275665076772844ebfe5167e54f6
exploit, web
-
vuldb.com
/vuln/368251
vdb-entry, web
-
vuldb.com
/vuln/368251/cti
signature, permissions-required, web
-
vuldb.com
/cve/CVE-2026-10802
third-party-advisory, web
-
vuldb.com
/submit/831461
third-party-advisory, web
-
github.com
/keystonejs/keystone/issues/9789
issue-tracking, web
-
github.com
/keystonejs/keystone/
product
-
nvd.nist.gov
/vuln/detail/CVE-2026-10802
advisory
-
github.com
/keystonejs/keystone
package
Sources
- CVE List CVE-2026-10802
- GitHub Advisory GHSA-45jq-c8xm-jfw9
- NVD CVE-2026-10802
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.