Executive brief
KeystoneJS is a headless content management system (CMS) used to manage website data and APIs. A configuration issue in certain versions causes the system to incorrectly identify itself as being in a 'development' mode even when deployed in a 'production' environment. This could lead to the accidental exposure of sensitive debugging information or the bypass of security checks that are only active in production mode.
Technical details
A vulnerability exists in @keystone-6/core versions 3.0.0 and 3.0.1 where the build process, utilizing esbuild, defaults the NODE_ENV environment variable to 'development' because the platform configuration is undefined. This causes user-authored TypeScript code to have 'development' inlined as a constant, even in production builds. If developers use NODE_ENV checks to gate security-sensitive functionality (e.g., disabling authentication or enabling verbose error reporting in dev), those checks will fail to protect the production environment. This issue specifically affects user code rather than third-party dependencies in node_modules. The vulnerability is resolved in version 3.0.2 by correctly configuring the esbuild platform.
Affected products
- KeystoneJS @keystone-6/core 3.0.0, 3.0.1
Timeline
- 2022-10-23: patched: Fix merged in pull request 8031
- 2022-11-03: advisory: GitHub Advisory GHSA-25mx-2mxm-6343 published
- 2022-11-03: disclosed: CVE-2022-39382 published to NVD