Executive brief
Directus is an open-source headless CMS and backend platform. An authenticated attacker can inject malicious JavaScript code that gets stored on the server and executed in other users' browsers when they view the affected content, potentially leading to account compromise or data theft. This vulnerability was later patched and the advisory was withdrawn as a duplicate.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw (CWE-79) in Directus v10.13.0 where an authenticated attacker can inject malicious JavaScript through an attacker-controlled parameter that is stored server-side and subsequently rendered unsanitized into the DOM on the client. The attack requires authentication and user interaction (victim viewing the injected content). When chained with CVE-2024-6534, an attacker could escalate to account takeover. The issue was identified in the npm package directus affecting version 10.13.0 and earlier.
Affected products
- Directus Directus 10.13.0 and earlier
Timeline
- 2024-08-15: disclosed
- 2025-03-22: other: Advisory withdrawn as duplicate of GHSA-9qrm-48qf-r2rw