VulnerableCode Package Details - pkg:npm/directus@11.1.0

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-9pfu-bhz9-13ea	Session is cached for OpenID and OAuth2 if `redirect` is not used Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include `redirect` query string. For example: - Project is configured with OpenID or OAuth2 - Project is configured with cache enabled - User tries to login via SSO link, but without `redirect` query string - After successful login, credentials are cached - If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user The SSO link is something like `https://directus.example.com/auth/login/openid/callback`, where `openid` is the name of the OpenID provider configured in Directus	CVE-2024-45596 GHSA-cff8-x7jv-4fm8
VCID-z7yb-1fvm-bqes	Directus vulnerable to SSRF Loopback IP filter bypass If you're relying on blocking access to localhost using the default `0.0.0.0` filter this can be bypassed using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`)	CVE-2024-46990 GHSA-68g8-c275-xf2m

Vulnerability

Summary

Aliases

VCID-9pfu-bhz9-13ea

Session is cached for OpenID and OAuth2 if `redirect` is not used Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include `redirect` query string. For example: - Project is configured with OpenID or OAuth2 - Project is configured with cache enabled - User tries to login via SSO link, but without `redirect` query string - After successful login, credentials are cached - If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user The SSO link is something like `https://directus.example.com/auth/login/openid/callback`, where `openid` is the name of the OpenID provider configured in Directus

CVE-2024-45596
GHSA-cff8-x7jv-4fm8

VCID-z7yb-1fvm-bqes

Directus vulnerable to SSRF Loopback IP filter bypass If you're relying on blocking access to localhost using the default `0.0.0.0` filter this can be bypassed using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`)

CVE-2024-46990
GHSA-68g8-c275-xf2m

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T16:45:47.367269+00:00	GithubOSV Importer	Fixing	VCID-z7yb-1fvm-bqes	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-68g8-c275-xf2m/GHSA-68g8-c275-xf2m.json	38.6.0
2026-06-04T16:45:27.218076+00:00	GithubOSV Importer	Fixing	VCID-9pfu-bhz9-13ea	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-cff8-x7jv-4fm8/GHSA-cff8-x7jv-4fm8.json	38.6.0
2026-06-04T16:22:17.921706+00:00	GitLab Importer	Fixing	VCID-z7yb-1fvm-bqes	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/directus/CVE-2024-46990.yml	38.6.0
2026-06-04T16:22:15.020266+00:00	GitLab Importer	Fixing	VCID-9pfu-bhz9-13ea	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/directus/CVE-2024-45596.yml	38.6.0