CVSS 3.1
4.6 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NCVE-2024-54128
Medium (4.6) in monospace directus. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in @directus/app 13.3.1.
Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
- CWE
- CWE-80
- Published
- Modified
- Record from
- the NVD, synced
Affected
- monospace:directus
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r6wx-627v-gh2f | npm | @directus/app | >=11.0.0 <13.3.1 | 13.3.1 |
| GHSA-r6wx-627v-gh2f | npm | directus | >=10.10.0 <10.13.4 | 10.13.4 |
| GHSA-r6wx-627v-gh2f | npm | directus | >=11.0.0-rc.1 <11.2.2 | 11.2.2 |