CVE-2022-0087

Deeper analysis

Keystone, an open-source Node.js-based content management system, contains a cross-site scripting vulnerability (CWE-79) that stems from improper neutralization of user input during web page generation. The flaw affects the rendering of input in web pages and carries a CVSS 3.1 score of 6.1 with a network attack vector, low complexity, no required privileges, and required user interaction, resulting in limited confidentiality and integrity impacts with changed scope.

An unauthenticated remote attacker can supply crafted input that is later rendered in a victim's browser when the victim interacts with a malicious link or page. Successful exploitation allows the attacker to execute arbitrary scripts in the context of the affected Keystone application, potentially stealing session data or performing actions on behalf of the victim within the application's security boundary.

Public references point to a specific commit (96bf833a23b1a0a5d365cf394467a943cc481b38) that addresses the issue in the Keystone repository, along with a corresponding huntr.dev bounty report. Security practitioners should apply the referenced patch or upgrade to a version containing the fix to neutralize the input before it is rendered. The associated EPSS score has remained in the 0.53 range with a modest peak of 0.56, indicating moderate and stable exploitation interest since disclosure.