PT-2023-32980 · Unknown+1 · @Keystone-6+2

Published 2023-06-12 · Updated 2023-06-12

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions @keystone-6/* versions (affected versions not specified)

Description The cuid package is deprecated and marked as insecure by its author due to security concerns. It is recommended to use @paralleldrive/cuid2 instead. The issue affects @keystone-6/* and its upstream dependencies. There have been no reported real-world incidents of this issue being exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-5FP6-4XW3-XQQ3

Affected Products

@Keystone-6

@Paralleldrive/Cuid2

Cuid

References · 5

• https://osv.dev/vulnerability/GHSA-5fp6-4xw3-xqq3 · Vendor Advisory
• https://github.com/keystonejs/keystone · Note
• https://github.com/keystonejs/keystone/issues/8282#issuecomment-1586019823 · Note
• https://github.com/keystonejs/keystone/security/advisories/GHSA-5fp6-4xw3-xqq3 · Note
• https://github.com/paralleldrive/cuid#status-deprecated-due-to-security-use-cuid2-instead · Note