{"id":"CVE-2024-54128","aliases":["EUVD-2024-3503","GHSA-r6wx-627v-gh2f"],"status":"published","title":"Directus has an HTML Injection in Comment","description":"Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00344,"percentile":0.28293,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-80"],"published":"2024-12-05T16:55:53Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"npm","package":"@directus/app","fixed_in":["13.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"directus","fixed_in":["10.13.4","11.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@directus/app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"13.3.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"directus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.10.0"},{"fixed":"10.13.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"directus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-rc.1"},{"fixed":"11.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@directus/app","ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"13.3.1"}]}]},{"source":"osv","ecosystem":"npm","package":"directus","ranges":[{"type":"SEMVER","events":[{"introduced":"10.10.0"},{"fixed":"10.13.4"}]}]},{"source":"osv","ecosystem":"npm","package":"directus","ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0-rc.1"},{"fixed":"11.2.2"}]}]}],"products":[{"vendor":"directus","product":"directus"},{"vendor":"monospace","product":"directus"}],"references":[{"url":"https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54128","tags":["advisory"]},{"url":"https://github.com/directus/directus/commit/4487fb18d5cb09e071b111d2dc0c9d6bcb437633","tags":["web"]},{"url":"https://github.com/directus/directus/commit/c89dbb233fbad2fd0cf41eb99d50c6de4e84195d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r6wx-627v-gh2f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54128.json","tags":["advisory"]},{"url":"https://github.com/directus/directus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-54128","title":"Directus has an HTML Injection in Comment","description":"Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.","status":"published","published":"2024-12-05T16:55:53.434Z","modified":"2024-12-06T15:56:34.323Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:33:59.177173Z"}],"euvd":[{"id":"EUVD-2024-3503","description":"Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.","status":"published","published":"2024-12-05T16:55:53Z","modified":"2024-12-06T15:56:34Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:39.149757Z"}],"ghsa":[{"id":"GHSA-r6wx-627v-gh2f","title":"Directus has an HTML Injection in Comment","description":"### Summary\nThe Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection.\n\n### Details\nThe Comment feature implements a character filter on the client-side, this can be bypassed by directly sending a request to the endpoint.\n\nExample Request:\n\n```\nPATCH /activity/comment/3 HTTP/2\nHost: directus.local\n\n{\n  \"comment\": \"\u003ch1\u003eTEST \u003cp style=\\\"color:red\\\"\u003eHTML INJECTION\u003c/p\u003e \u003ca href=\\\"//evil.com\\\"\u003eTest Link\u003c/a\u003e\u003c/h1\u003e\"\n}\n```\n\nExample Response:\n\n```json\n{\n  \"data\": {\n    \"id\": 3,\n    \"action\": \"comment\",\n    \"user\": \"288fdccc-399a-40a1-ac63-811bf62e6a18\",\n    \"timestamp\": \"2023-09-06T02:23:40.740Z\",\n    \"ip\": \"10.42.0.1\",\n    \"user_agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\n    \"collection\": \"directus_files\",\n    \"item\": \"7247dda1-c386-4e7a-8121-7e9c1a42c15a\",\n    \"comment\": \"\u003ch1\u003eTEST \u003cp style=\\\"color:red\\\"\u003eHTML INJECTION\u003c/p\u003e \u003ca href=\\\"//evil.com\\\"\u003eTest Link\u003c/a\u003e\u003c/h1\u003e\",\n    \"origin\": \"https://directus.local\",\n    \"revisions\": []\n  }\n}\n```\n\nExample Result:\n\n![Screenshot 2023-09-06 094536](https://user-images.githubusercontent.com/61263002/265876100-12e068fe-3d53-41b4-bfcb-458c2bc2a638.png)\n\n## Impact\n\nWith the introduction of session cookies this issue has become exploitable as a malicious script is now able to do authenticated actions on the current users behalf.","status":"published","published":"2024-12-05T22:37:32Z","modified":"2025-11-19T17:50:44Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:39:08.983925Z"}],"nvd":[{"id":"CVE-2024-54128","description":"Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.","status":"published","published":"2024-12-05T17:15:15.13Z","modified":"2026-06-17T08:09:49.4Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:10:39.434419Z"}],"osv":[{"id":"CVE-2024-54128","title":"Directus has an HTML Injection in Comment","description":"Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.","status":"published","published":"2024-12-05T16:55:53.434Z","modified":"2026-10-28T02:30:33.400649179Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"GHSA-r6wx-627v-gh2f","title":"Directus has an HTML Injection in Comment","description":"### Summary\nThe Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection.\n\n### Details\nThe Comment feature implements a character filter on the client-side, this can be bypassed by directly sending a request to the endpoint.\n\nExample Request:\n\n```\nPATCH /activity/comment/3 HTTP/2\nHost: directus.local\n\n{\n  \"comment\": \"\u003ch1\u003eTEST \u003cp style=\\\"color:red\\\"\u003eHTML INJECTION\u003c/p\u003e \u003ca href=\\\"//evil.com\\\"\u003eTest Link\u003c/a\u003e\u003c/h1\u003e\"\n}\n```\n\nExample Response:\n\n```json\n{\n  \"data\": {\n    \"id\": 3,\n    \"action\": \"comment\",\n    \"user\": \"288fdccc-399a-40a1-ac63-811bf62e6a18\",\n    \"timestamp\": \"2023-09-06T02:23:40.740Z\",\n    \"ip\": \"10.42.0.1\",\n    \"user_agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\n    \"collection\": \"directus_files\",\n    \"item\": \"7247dda1-c386-4e7a-8121-7e9c1a42c15a\",\n    \"comment\": \"\u003ch1\u003eTEST \u003cp style=\\\"color:red\\\"\u003eHTML INJECTION\u003c/p\u003e \u003ca href=\\\"//evil.com\\\"\u003eTest Link\u003c/a\u003e\u003c/h1\u003e\",\n    \"origin\": \"https://directus.local\",\n    \"revisions\": []\n  }\n}\n```\n\nExample Result:\n\n![Screenshot 2023-09-06 094536](https://user-images.githubusercontent.com/61263002/265876100-12e068fe-3d53-41b4-bfcb-458c2bc2a638.png)\n\n## Impact\n\nWith the introduction of session cookies this issue has become exploitable as a malicious script is now able to do authenticated actions on the current users behalf.","status":"published","published":"2024-12-05T22:37:32Z","modified":"2025-11-19T17:50:43Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}