Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 12 June 2023.

Which products and versions are affected?

@keystone-6/core (npm) SEMVER:introduced=0,last_affected=5.3.1.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run @keystone-6/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Keystone-6 insecure cuid identifier dependency

Severity: info · Published 2023-06-12

Keystone-6/core, a headless CMS platform, uses a deprecated and cryptographically insecure identifier library (cuid) by default for generating database record IDs. The cuid package leaks timing information, which could theoretically enable attackers to predict or enumerate object identifiers in applications built with Keystone-6. While not a direct code vulnerability, using this weak identifier scheme undermines security in typical database applications and should be replaced with a modern secure alternative.

Technologies: @keystone-6/core (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 12 June 2023.
Which products and versions are affected?: @keystone-6/core (npm) SEMVER:introduced=0,last_affected=5.3.1.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run @keystone-6/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from Keystone-6/core's use of the deprecated cuid package for generating database identifiers by default. Cuid is a k-sortable, monotonically increasing ID scheme that embeds timestamp information, making it non-cryptographic and unsuitable for security-sensitive applications. The attack vector requires no network access or special privileges—any user of Keystone-6 with the default configuration inherits this weak identifier behavior. An attacker can analyze the timestamp and sequence components of cuid identifiers to predict future IDs or enumerate existing records. The maintainers recommend migrating to @paralleldrive/cuid2, which generates random 24-character base36 strings, or implementing application-specific secure ID strategies. No patch version has been released; workarounds exist for custom identifier implementations, but the default configuration remains affected.

Affected products

Keystone @keystone-6/core All versions up to and including 5.3.1

Timeline

2023-06-12: disclosed: GHSA-5fp6-4xw3-xqq3 published; advisory accepted by maintainer

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.