CVE-2022-39322 is a critical-severity (CVSS 9.1) CWE-285 vulnerability in @keystone-6/core. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for @keystone-6/core — see the affected versions and patch details below.
@keystone-6/core vulnerable to field-level access-control bypass for multiselect field
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for CVE-2022-39322.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@keystone-6/corenpmDescription
Impact
@keystone-6/[email protected] || 2.3.0 users who are using the multiselect field, and provided field-level access control - are vulnerable to their field-level access control not being used.
List-level access control is NOT affected.
Field-level access control for fields other than multiselect are NOT affected.
Example, you are vulnerable if you are using field-level access control on a multiselect like the following:
const yourList = list({
access: {
// this is list-level access control, this is NOT impacted
},
fields: {
yourFieldName: multiselect({
// this is field-level access control, for multiselect fields
// this is vulnerable
access: {
create: ({ session }) => session?.data.isAdmin,
update: ({ session }) => session?.data.isAdmin,
},
options: [
{ value: 'apples', label: 'Apples' },
{ value: 'oranges', label: 'Oranges' },
],
// ...
}),
// ...
},
// ...
});
Mitigation
Please upgrade to @keystone-6/core >= 2.3.1, where this vulnerability has been closed.
Workarounds
If for some reason you cannot upgrade your dependencies, you should stop using the multiselect field.
Credits
Thanks to Marek R for reporting and submitting the pull request to fix this problem.
If you have any questions around this security advisory, please don't hesitate to contact us at [email protected], or open an issue on GitHub.
If you have a security flaw to report for any software in this repository, please see our SECURITY policy.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @keystone-6/core | ≥ 2.2.0&&< 2.3.1 | 2.3.1npm install @keystone-6/core@2.3.1 |
Affected Products
keystonekeystonejsResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @keystone-6/core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @keystone-6/core to 2.3.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-39322 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is CVE-2022-39322 in your dependencies?
Find it across npm, including transitive dependencies.