directus (npm)
Advisories
63
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 12.0.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install directus@12.0.0yarn
yarn add directus@12.0.0pnpm
pnpm add directus@12.0.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-c6w9-5g5j-jh2p Directus: Authorization-dependent response served from unsegmented cache key |
High EPSS 0.47% |
< 12.0.0 | 12.0.0 |
| GHSA-j5h6-vqc3-phqh Directus: SSRF Protection Bypass via 0.0.0.0 in File Import |
High EPSS 0.41% |
< 12.0.0 | 12.0.0 |
| GHSA-38hg-ww64-rrwc Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries |
High EPSS 0.34% |
< 11.17.0 | 11.17.0 |
| GHSA-6q22-g298-grjh Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver |
High | < 11.17.0 | 11.17.0 |
| GHSA-ph52-67fq-75wj Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits |
Medium EPSS 0.36% |
< 11.17.0 | 11.17.0 |
| GHSA-mvv8-v4jj-g47j Directus: Sensitive fields exposed in revision history |
Medium EPSS 0.17% |
< 11.17.0 | 11.17.0 |
| GHSA-qqmv-5p3g-px89 Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite |
High EPSS 0.30% |
< 11.16.1 | 11.16.1 |
| GHSA-wv3h-5fx7-966h Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import |
High EPSS 0.34% |
< 11.16.0 | 11.16.0 |
| GHSA-wxwm-3fxv-mrvx Directus: GraphQL Schema SDL Disclosure Setting |
Medium EPSS 0.31% |
< 11.16.1 | 11.16.1 |
| GHSA-cf45-hxwj-4cfj Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow |
Medium EPSS 0.26% |
< 11.16.1 | 11.16.1 |
| GHSA-q75c-4gmv-mg9x Directus: Open Redirect in Admin 2FA Setup Page |
Medium EPSS 0.26% |
< 11.16.1 | 11.16.1 |
| GHSA-393c-p46r-7c95 Directus: Path Traversal and Broken Access Control in File Management API |
High EPSS 0.20% |
< 11.17.0 | 11.17.0 |
| GHSA-8m32-p958-jg99 Directus: Missing Cross-Origin Opener Policy |
Critical EPSS 0.17% |
< 11.17.0 | 11.17.0 |
| GHSA-jr94-gj3h-c8rf Directus Vulnerable to User Enumeration via Password Reset Timing Attack |
Medium EPSS 0.39% |
< 11.14.1 | 11.14.1 |
| GHSA-3573-4c68-g8cc Directus has open redirect in SAML |
Medium EPSS 0.23% |
< 11.14.0 | 11.14.0 |
| GHSA-cph6-524f-3hgr Directus Vulnerable to Information Leakage in Existing Collections |
Medium EPSS 0.35% |
< 11.13.0 | 11.13.0 |
| GHSA-8jpw-gpr4-8cmh Directus's conceal fields are searchable if read permissions enabled |
Medium EPSS 0.30% |
< 11.13.0 | 11.13.0 |
| GHSA-vv2v-pw69-8crf Directus is Vulnerable to Stored Cross-site Scripting |
Medium EPSS 0.26% |
< 11.13.0 | 11.13.0 |
| GHSA-9x5g-62gj-wqf2 Directus has Improper Permission Handling on Deleted Fields |
Medium EPSS 0.21% |
< 11.13.0 | 11.13.0 |
| GHSA-mv33-9f6j-pfmc Directus allows unauthenticated file upload and file modification due to lacking input sanitization |
High EPSS 1.40% |
>= 10.8.0, < 11.9.3 | 11.9.3 |
| GHSA-7cvf-pxgp-42fc Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows |
Medium EPSS 0.46% |
< 11.9.0 | 11.9.0 |
| GHSA-rmjh-cf9q-pv7q Directus' exact version number is exposed by the OpenAPI Spec |
Medium EPSS 1.02% |
< 11.9.0 | 11.9.0 |
| GHSA-f24x-rm6g-3w5v Directus tokens are not redacted in flow logs, exposing session credentials to all admin |
Medium EPSS 0.46% |
< 11.9.0 | 11.9.0 |
| GHSA-x3vm-88hf-gpxp Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged |
Medium EPSS 0.20% |
>= 9.0.0, < 11.9.0 | 11.9.0 |
| GHSA-fm3h-p9wm-h74h Directus's webhook trigger flows can leak sensitive data |
High EPSS 0.53% |
>= 9.12.0, < 11.5.0 | 11.5.0 |
| GHSA-7wq3-jr35-275c Directus `search` query parameter allows enumeration of non permitted fields |
Medium EPSS 0.38% |
>= 9.0.0-alpha.4, < 11.5.0 | 11.5.0 |
| GHSA-56p6-qw3c-fq2g Suspended Directus user can continue to use session token to access API |
Medium EPSS 0.37% |
>= 10.10.0, < 11.5.0 | 11.5.0 |
| GHSA-rv78-qqrq-73m5 Directus's S3 assets become unavailable after a burst of HEAD requests |
Medium EPSS 0.44% |
>= 9.22, < 11.5.0 | 11.5.0 |
| GHSA-j8xj-7jff-46mx Directus's S3 assets become unavailable after a burst of malformed transformations |
Medium EPSS 0.44% |
>= 9.22.0, < 11.5.0 | 11.5.0 |
| GHSA-99vm-5v2h-h6r6 Directus allows updates to non-allowed fields due to overlapping policies |
Medium EPSS 0.24% |
>= 11.0.0, < 11.1.2 | 11.1.2 |
| GHSA-pmf4-v838-29hg Directus allows privilege escalation using Share feature |
Medium EPSS 0.40% |
< 11.2.0 | 11.2.0 |
| GHSA-849r-qrwj-8rv4 Directus allows unauthenticated access to WebSocket events and operations |
High EPSS 0.69% |
>= 11.0.0, < 11.3.0 | 11.3.0 |
| GHSA-r6wx-627v-gh2f Directus has an HTML Injection in Comment |
Medium EPSS 0.34% |
>= 11.0.0-rc.1, < 11.2.2 | 11.2.2 |
| GHSA-r6wx-627v-gh2f Directus has an HTML Injection in Comment |
Medium EPSS 0.34% |
>= 10.10.0, < 10.13.4 | 10.13.4 |
| GHSA-68g8-c275-xf2m Directus vulnerable to SSRF Loopback IP filter bypass |
Medium EPSS 0.47% |
< 10.13.3 | 10.13.3 |
| GHSA-68g8-c275-xf2m Directus vulnerable to SSRF Loopback IP filter bypass |
Medium EPSS 0.47% |
>= 11.0.0, < 11.1.0 | 11.1.0 |
| GHSA-cff8-x7jv-4fm8 Session is cached for OpenID and OAuth2 if `redirect` is not used |
Medium EPSS 0.66% |
< 10.13.3 | 10.13.3 |
| GHSA-cff8-x7jv-4fm8 Session is cached for OpenID and OAuth2 if `redirect` is not used |
Medium EPSS 0.66% |
>= 11.0.0-rc.1, < 11.1.0 | 11.1.0 |
| GHSA-q83v-hq3j-4pq3 Duplicate Advisory: Improper access control in Directus Withdrawn |
Medium | <= 10.13.0 | No fix yet |
| GHSA-3fff-gqw3-vj86 Directus has an insecure object reference via PATH presets |
Medium EPSS 0.33% |
< 10.13.2 | 10.13.2 |
| GHSA-qf6h-p3mr-vmh5 Duplicate Advisory: Code injection in Directus Withdrawn |
Medium | <= 10.13.0 | No fix yet |
| GHSA-9qrm-48qf-r2rw Directus has a DOM-Based cross-site scripting (XSS) via layout_options |
Medium EPSS 0.38% |
< 11.3.3 | 11.3.3 |
| GHSA-jgf4-vwc3-r46v Directus Allows Single Sign-On User Enumeration |
Medium EPSS 0.51% |
>= 9.11, < 10.13.0 | 10.13.0 |
| GHSA-hxgm-ghmv-xjjm Directus incorrectly handles `_in` filter |
High EPSS 0.42% |
>= 9.23.0, < 10.6.0 | 10.6.0 |
| GHSA-632p-p495-25m5 Directus is soft-locked by providing a string value to random string util |
High EPSS 0.62% |
< 10.11.2 | 10.11.2 |
| GHSA-g65h-35f3-x2w3 Directus Lacks Session Tokens Invalidation |
Medium EPSS 0.45% |
>= 10.10.0, < 10.11.0 | 10.11.0 |
| GHSA-p8v3-m643-4xqx Directus allows redacted data extraction on the API through "alias" |
Medium EPSS 0.76% |
< 10.11.0 | 10.11.0 |
| GHSA-fr3w-2p22-6w7p URL Redirection to Untrusted Site in OAuth2/OpenID in directus |
Medium EPSS 0.58% |
< 10.10.0 | 10.10.0 |
| GHSA-2ccr-g2rv-h677 Session Token in URL in directus |
Low EPSS 0.24% |
< 10.10.0 | 10.10.0 |
| GHSA-5mhg-wv8w-p59j Directus version number disclosure |
Medium EPSS 0.57% |
< 10.8.3 | 10.8.3 |
| GHSA-qw9g-7549-7wg5 Directus has MySQL accent insensitive email matching |
High EPSS 0.70% |
< 10.8.3 | 10.8.3 |
| GHSA-hmgw-9jrg-hf2m Directus crashes on invalid WebSocket message |
Medium EPSS 0.83% |
>= 10.4.0, < 10.6.2 | 10.6.2 |
| GHSA-22rr-f3p8-5gf8 Directus affected by VM2 sandbox escape vulnerability |
High | < 10.6.0 | 10.6.0 |
| GHSA-gggm-66rh-pp98 Incorrect Permission Checking for GraphQL Subscriptions |
Medium EPSS 0.50% |
>= 10.3.0, < 10.5.0 | 10.5.0 |
| GHSA-3gvp-54v2-2jrp Directus API vulnerable to denial of service |
Medium EPSS 1.08% |
>= 2.2.0, < 2.2.1 | 2.2.1 |
| GHSA-8vg2-wf3q-mwv7 directus vulnerable to Insertion of Sensitive Information into Log File |
Medium EPSS 0.31% |
< 9.23.3 | 9.23.3 |
| GHSA-m5q3-8wgf-x8xf Directus vulnerable to extraction of password hashes through export querying |
Medium EPSS 0.60% |
< 9.16.0 | 9.16.0 |
| GHSA-4hmq-ggrm-qfc6 directus vulnerable to HTML Injection in Password Reset email to custom Reset URL |
Medium EPSS 0.53% |
< 9.23.0 | 9.23.0 |
| GHSA-j3rg-3rgm-537h Directus vulnerable to Server-Side Request Forgery On File Import |
High EPSS 0.96% |
< 9.23.0 | 9.23.0 |
| GHSA-77qm-wvqq-fg79 Directus vulnerable to unhandled exception on illegal filename_disk value |
Medium EPSS 0.97% |
< 9.15.0 | 9.15.0 |
| GHSA-5h75-pvq4-82c9 Server-Side Request Forgery in Directus |
Medium EPSS 0.83% |
>= 9.0.0-beta.2, < 9.7.0 | 9.7.0 |
| GHSA-g27j-74fp-xfpr Insecure default value for CORS configuration |
Critical EPSS 1.00% |
< 9.7.0 | 9.7.0 |
| GHSA-xmjj-3c76-5w84 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus |
High EPSS 1.03% |
< 9.7.0 | 9.7.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor