Back to Database
Status published
Medium
CVE-2024-54128
Directus has an HTML Injection in Comment
Vulnerability Description
Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection. This vulerability is fixed in 10.13.4 and 11.2.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-54128
Credits & Attribution
No credits recorded in the NVD database.
More from directus
View All →CVE-2025-64749
Directus Vulnerable to Information Leakage in Existing Collections
Medium
4.3
CVE-2025-64748
Directus's conceal fields are searchable if read permissions enabled
Medium
6.5
CVE-2025-64747
Directus Vulnerable to Stored Cross-site Scripting
Medium
5.5
CVE-2025-64746
Directus has Improper Permission Handling on Deleted Fields
Medium
4.6
CVE-2025-55746
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
Critical
9.3
Affected Vendor
directus
View all reports →Affected Software
directus
Vulnerable Versions:
>= 10.10.0, < 10.13.4, >= 11.0.0-rc.1, < 11.2.0
Timeline
Official Publish:
December 5th, 2024
Last Modified:
December 6th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N