keystone@4.0.0-rc.1 vulnerabilities

Web Application Framework and Admin GUI / Content Management System built on Express.js and Mongoose

Direct Vulnerabilities

Known vulnerabilities in the keystone package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Arbitrary File Upload

keystone is a Node.js content management system and web app framework built on the Express web framework and Mongoose ODM.

Affected versions of this package are vulnerable to Arbitrary File Upload via the file upload module, due to missing sanitization, allowing an attacker to execute arbitrary code via a crafted file.

How to fix Arbitrary File Upload?

There is no fixed version for keystone.

*