DOM-Based XSS Vulnerability in Directus: Account Takeover Risk
Summary
GHSA-9qrm-48qf-r2rw: Directus has a DOM-Based cross-site scripting (XSS) via layout_options. Affects directus versions < 11.3.3. Fixed in 11.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that allows users to manage their content through a user-friendly interface. It supports various databases and provides a RESTful API for developers. However, it has been found to be vulnerable to a DOM-based cross-site scripting (XSS) attack, which can be exploited by authenticated users to inject malicious scripts into the application.
Vulnerability Detail
The vulnerability arises from the ability of an authenticated attacker to save XSS code into the database via the layout_options parameter. This unsanitized input is then rendered in the client-side DOM, allowing the attacker to execute arbitrary JavaScript code. When combined with CVE-2024-6534, this vulnerability could lead to account takeover, posing significant security risks to users.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.3.3
This is the first release that contains the fix.
npm install directus@11.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that users with non-administrative roles do not have the ability to create or modify presets that include unsanitized input. Additionally, implementing Content Security Policy (CSP) headers can help mitigate the risk of XSS attacks.
Conclusion
The DOM-based XSS vulnerability in Directus poses a significant risk, particularly for authenticated users. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application. Regular monitoring and adherence to security best practices are recommended to prevent such vulnerabilities.
See every vulnerability recorded for directus →
FAQ
The vulnerability is a DOM-based cross-site scripting (XSS) issue that allows authenticated users to inject malicious scripts into the application.
Any user with an authenticated account in Directus can potentially exploit this vulnerability, especially those with permissions to create or modify presets.
Exploitation of this vulnerability could lead to account takeover, data theft, or unauthorized actions performed on behalf of the affected user.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 3.4, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
