{"action":"Upgrade @keystone-6/core to 6.5.3 or later.","affected":[{"fixed":"6.5.3","introduced":"0"}],"component":"@keystone-6/core","cve_ids":["CVE-2026-63421"],"ecosystem":"npm","epss":0.0067,"exploited":false,"fixed_versions":["6.5.3"],"ghsa_id":"GHSA-cqmq-8755-7xvh","id":"tcs_01M5KFKC9SWFGGVJKS9NB8DQ13","modified_at":"2026-08-21T21:10:59.624585Z","published_at":"2026-08-21T20:55:11Z","references":["https://osv.dev/vulnerability/GHSA-cqmq-8755-7xvh","https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh","https://github.com/keystonejs/keystone/pull/9859","https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1","https://github.com/keystonejs/keystone","https://github.com/keystonejs/keystone/releases/tag/@keystone-6/core@6.5.3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cqmq-8755-7xvh","url":"https://osv.dev/vulnerability/GHSA-cqmq-8755-7xvh"}],"summary":"Keystone vulnerable to `graphql.maxTake` bypass with negative `take`"}