How severe is GHSA-5fp6-4xw3-xqq3?

No CVSS score has been assigned to GHSA-5fp6-4xw3-xqq3 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-5fp6-4xw3-xqq3?

GHSA-5fp6-4xw3-xqq3 affects the following packages: @keystone-6/core (npm). Ecosystems affected: npm.

How do I fix GHSA-5fp6-4xw3-xqq3?

The records we use list no patched version of @keystone-6/core for GHSA-5fp6-4xw3-xqq3. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.

How do I detect GHSA-5fp6-4xw3-xqq3 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @keystone-6/core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-5fp6-4xw3-xqq3 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-5fp6-4xw3-xqq3 actively exploited in the wild?

No public exploit code has been indexed for GHSA-5fp6-4xw3-xqq3 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-5fp6-4xw3-xqq3 published, and has it been updated?

GHSA-5fp6-4xw3-xqq3 was published on June 12, 2023 and was last updated on June 23, 2023. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

@keystone-6/core's bundled cuid package known to be insecureGHSA-5fp6-4xw3-xqq3

GHSA-5fp6-4xw3-xqq3 is a security vulnerability in @keystone-6/core. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Published

Jun 12, 2023

Updated

Jun 23, 2023

Affected

1 pkg

Patched

None yet

Exploits

None indexed

Exploitation data as of Jun 23, 2023 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

19other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

@keystone-6/corenpm

21Kdownloads / week

Description

Summary

The cuid package used by @keystone-6/* and upstream dependencies is deprecated and marked as insecure by the author.

As reported by the author

Cuid and other k-sortable and non-cryptographic ids (Ulid, ObjectId, KSUID, all UUIDs) are all insecure. Use @paralleldrive/cuid2 instead.

What are doing about this?

We are waiting on Prisma to add support for cuid2
Alternatively, we might default to a random string ourselves

What can I do about this?

We have added a work-around for users who want to provide custom identifiers in https://github.com/keystonejs/keystone/pull/8645

What if I need a `cuid`?

The features marked as a security vulnerability by @paralleldrive are sometimes actually needed (as written in the README of cuid) - the problem is the inherent risks that features like this can have.

You might actually want the features of a monotonically increasing (auto-increment, k-sortable), and timestamp-based id as part of your application, and keystone should support that - but you might not want them by default. This is why this security advisory has been accepted by me (@dcousens), we currently use cuid identifiers by default, and that should change.

Impact

I have accepted this security advisory on the basis that we don't need this kind of identifier typically, and the need for them should be driven by an application's requirements, not a convenient default.

Affected Packages

1 total

Ecosystem	Package	Vulnerable range	Fix
📦npm	`@keystone-6/core`	all versions	No fix

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @keystone-6/core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
The records we use list no patched version of @keystone-6/core for GHSA-5fp6-4xw3-xqq3. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary The `cuid` package used by `@keystone-6/*` and upstream dependencies is deprecated and [marked as insecure by the author](https://github.com/paralleldrive/cuid#status-deprecated-due-to-security-use-cuid2-instead). As reported by the author > Cuid and other k-sortable and non-cryptographic ids (Ulid, ObjectId, KSUID, all UUIDs) are all insecure. Use @paralleldrive/cuid2 instead. ### What are doing about this? - [We are waiting on Prisma](https://github.com/keystonejs/keystone/issues/8282) to add support for [`cuid2`](https://github.com/paralleldrive/cuid2) - Alternatively, we migh

O3 Security · Impact-Aware SCA

Is GHSA-5fp6-4xw3-xqq3 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works