Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-n6nd-tbf1-k7aj
Vulnerability ID VCID-n6nd-tbf1-k7aj
Aliases CVE-2024-54128
GHSA-r6wx-627v-gh2f
Summary Directus has an HTML Injection in Comment The Comment feature has implemented a filter to prevent users from adding restricted characters, such as HTML tags. However, this filter operates on the client-side, which can be bypassed, making the application vulnerable to HTML Injection.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2024-54128
epss 0.00311 https://api.first.org/data/v1/epss?cve=CVE-2024-54128
cvssv3.1 5.7 https://github.com/directus/directus
generic_textual MODERATE https://github.com/directus/directus
cvssv3.1 5.7 https://github.com/directus/directus/commit/4487fb18d5cb09e071b111d2dc0c9d6bcb437633
generic_textual MODERATE https://github.com/directus/directus/commit/4487fb18d5cb09e071b111d2dc0c9d6bcb437633
cvssv3.1 5.7 https://github.com/directus/directus/commit/c89dbb233fbad2fd0cf41eb99d50c6de4e84195d
generic_textual MODERATE https://github.com/directus/directus/commit/c89dbb233fbad2fd0cf41eb99d50c6de4e84195d
cvssv3.1 5.7 https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f
generic_textual MODERATE https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f
ssvc Track https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f
cvssv3.1 5.7 https://nvd.nist.gov/vuln/detail/CVE-2024-54128
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-54128
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-54128
https://github.com/directus/directus
https://github.com/directus/directus/commit/4487fb18d5cb09e071b111d2dc0c9d6bcb437633
https://github.com/directus/directus/commit/c89dbb233fbad2fd0cf41eb99d50c6de4e84195d
CVE-2024-54128 https://nvd.nist.gov/vuln/detail/CVE-2024-54128
GHSA-r6wx-627v-gh2f https://github.com/advisories/GHSA-r6wx-627v-gh2f
GHSA-r6wx-627v-gh2f https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/directus/directus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/directus/directus/commit/4487fb18d5cb09e071b111d2dc0c9d6bcb437633
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/directus/directus/commit/c89dbb233fbad2fd0cf41eb99d50c6de4e84195d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-06T15:56:14Z/ Found at https://github.com/directus/directus/security/advisories/GHSA-r6wx-627v-gh2f
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-54128
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.54587
EPSS Score 0.00311
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:22:47.679138+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@directus/app/CVE-2024-54128.yml 38.6.0