p PatchFirst

PatchFirst · Latest vulnerabilities

@directus/app vulnerabilities

Vulnerabilities published for @directus/app in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2025-24353

    Medium · CVSS 5EPSS 0.39%Fix available

    Directus privilege escalation vulnerability using Share feature

    Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue.

    @directus/appNode.js
    • Update to 13.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2024-54128

    Medium · CVSS 5.7EPSS 0.34%Fix available

    Directus has an HTML Injection in Comment

    Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.

    @directus/appNode.js
    • Update to 13.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →