Keystone is a headless CMS for Node.js — built with GraphQL and React.@keystone-6/core@3.0.0 || 3.0.1 users that use NODE_ENV to trigger security-sensitive functionality in their production builds are vulnerable to NODE_ENV being inlined to "development" for user code, irrespective of what your environment variables. If you do not use NODE_ENV in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use NODE_ENV to trigger particular behaviors (optimizations, security or otherwise) should still respect your environment's configured NODE_ENV variable. The application's dependencies, as found in node_modules (including @keystone-6/core), are typically not compiled as part of this process, and thus should be unaffected. We have tested this assumption by verifying that NODE_ENV=production yarn keystone start still uses secure cookies when using statelessSessions. This vulnerability has been fixed in @keystone-6/core@3.0.2, regression tests have been added for this vulnerability in #8063.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-74"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39382.json"
}{
"extracted_events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.2"
},
{
"last_affected": "3.0.0"
},
{
"introduced": "3.0.1"
},
{
"last_affected": "3.0.1"
}
],
"cpe": [
"cpe:2.3:a:keystonejs:keystone:3.0.0:*:*:*:*:node.js:*:*",
"cpe:2.3:a:keystonejs:keystone:3.0.1:*:*:*:*:node.js:*:*"
],
"source": [
"AFFECTED_FIELD",
"CPE_STRING"
]
}