CVE-2022-39382: NODE_ENV in Keystone defaults to development with esbuild
Keystone is a headless CMS for Node.js — built with GraphQL and React.@keystone-6/core@3.0.0 || 3.0.1 users that use NODEENV to trigger security-sensitive functionality in their production builds are vulnerable to NODEENV being inlined to "development" for user code, irrespective of what your environment variables. If you do not use NODEENV in your user code to trigger security-sensitive functionality, you are not impacted by this vulnerability. Any dependencies that use NODEENV to trigger particular behaviors (optimizations, security or otherwise) should still respect your environment's configured NODEENV variable. The application's dependencies, as found in nodemodules (including @keystone-6/core), are typically not compiled as part of this process, and thus should be unaffected. We have tested this assumption by verifying that NODEENV=production yarn keystone start still uses secure cookies when using statelessSessions. This vulnerability has been fixed in @keystone-6/core@3.0.2, regression tests have been added for this vulnerability in #8063.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39382?
The severity of CVE-2022-39382 is classified as high due to the potential exposure of sensitive functionality in production builds.
How do I fix CVE-2022-39382?
To mitigate CVE-2022-39382, update your Keystone application to version 3.0.2 or later where the issue is resolved.
Who is affected by CVE-2022-39382?
CVE-2022-39382 affects users of Keystone versions 3.0.0 and 3.0.1 that rely on the NODE_ENV variable for security-sensitive configurations.
What are the consequences of CVE-2022-39382?
The consequences of CVE-2022-39382 may include unintended exposure of development settings that compromise application security.
Can I continue using Keystone 3.0.0 or 3.0.1 after CVE-2022-39382 is disclosed?
It is strongly advised to upgrade from Keystone 3.0.0 or 3.0.1 to avoid the vulnerabilities introduced by CVE-2022-39382.