@directus/api (npm)
Advisories
12
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 32.2.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install @directus/api@32.2.0yarn
yarn add @directus/api@32.2.0pnpm
pnpm add @directus/api@32.2.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-jr94-gj3h-c8rf Directus Vulnerable to User Enumeration via Password Reset Timing Attack |
Medium EPSS 0.39% |
< 32.2.0 | 32.2.0 |
| GHSA-3573-4c68-g8cc Directus has open redirect in SAML |
Medium EPSS 0.23% |
< 32.1.1 | 32.1.1 |
| GHSA-cph6-524f-3hgr Directus Vulnerable to Information Leakage in Existing Collections |
Medium EPSS 0.35% |
< 32.0.0 | 32.0.0 |
| GHSA-8jpw-gpr4-8cmh Directus's conceal fields are searchable if read permissions enabled |
Medium EPSS 0.30% |
< 32.0.0 | 32.0.0 |
| GHSA-mv33-9f6j-pfmc Directus allows unauthenticated file upload and file modification due to lacking input sanitization |
High EPSS 1.40% |
>= 14.1.0, < 28.0.2 | 28.0.2 |
| GHSA-56p6-qw3c-fq2g Suspended Directus user can continue to use session token to access API |
Medium EPSS 0.37% |
>= 18.0.0, < 24.0.1 | 24.0.1 |
| GHSA-99vm-5v2h-h6r6 Directus allows updates to non-allowed fields due to overlapping policies |
Medium EPSS 0.24% |
>= 22.0.0, < 23.1.0 | 23.1.0 |
| GHSA-849r-qrwj-8rv4 Directus allows unauthenticated access to WebSocket events and operations |
High EPSS 0.69% |
>= 22.2.0, < 23.2.0 | 23.2.0 |
| GHSA-68g8-c275-xf2m Directus vulnerable to SSRF Loopback IP filter bypass |
Medium EPSS 0.47% |
< 21.0.0 | 21.0.0 |
| GHSA-68g8-c275-xf2m Directus vulnerable to SSRF Loopback IP filter bypass |
Medium EPSS 0.47% |
>= 22.0.0, < 22.1.1 | 22.1.1 |
| GHSA-cff8-x7jv-4fm8 Session is cached for OpenID and OAuth2 if `redirect` is not used |
Medium EPSS 0.66% |
>= 22.0.0, < 22.2.0 | 22.2.0 |
| GHSA-cff8-x7jv-4fm8 Session is cached for OpenID and OAuth2 if `redirect` is not used |
Medium EPSS 0.66% |
< 21.0.1 | 21.0.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor